Impersonated Software Downloads Used to Deliver Malware via Lookalike Repos and Domains

Threat actors are abusing software-brand impersonation to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using fake GitHub repositories that impersonate established technology companies and leverage the ClickFix technique—prompting victims to copy/paste commands into Terminal (macOS) or PowerShell/Run (Windows)—to install infostealers. Datadog observed iterative updates to the MacSync lure and a new macOS infostealer variant self-branded as “SHub Stealer v2.0”, with expanded capabilities including persistence and remote access, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward Windows infostealer functionality.

Separately, Malwarebytes documented a lookalike 7-Zip download site (7zip[.]com, impersonating the legitimate 7-zip.org) distributing a trojanized installer that installs a working 7-Zip File Manager while silently converting infected Windows systems into residential proxy nodes. The installer was Authenticode-signed with a certificate issued to Jozeal Network Technology Co., Limited (now revoked), and it dropped additional components—Uphero.exe (service manager/update loader), hero.exe (Go-compiled proxy payload), and hero.dll—under C:\Windows\SysWOW64\hero\; one reported case surfaced via Microsoft Defender detection Trojan:Win32/Malgent!MSR after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from trusted-brand impersonation and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.