Loading story…
A widespread campaign is targeting macOS users with information-stealing malware via fake GitHub repositories impersonating popular tools. Attackers use SEO poisoning to push malicious sites in search results, leading users to download trojanized applications that deploy the Atomic Stealer malware. The campaign leverages multiple GitHub accounts to evade takedowns and employs social engineering to trick users into executing malicious commands.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 references tracked. Mallory keeps watching after this page renders.
infosecwriteups.com
Open sourcethehackernews.com
Open sourceinfosecwriteups.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A widespread campaign is delivering the Atomic (AMOS) infostealer to macOS users through fake GitHub repositories impersonating popular software. Attackers use SEO to promote these repositories, which instruct users to run terminal commands that install the malware. LastPass and other security teams are actively disrupting the campaign, but new repositories continue to appear.
Jun 29, 2026
Attackers are leveraging GitHub's reputation to distribute malicious MacOS software disguised as open-source projects. These repositories use SEO and namesquatting to appear in top search results, tricking users into downloading and executing harmful shell scripts. The campaigns employ multiple throwaway accounts and obfuscation techniques to evade detection.
Jun 29, 2026
An updated version of **Atomic Stealer** (also known as **AMOS**) was distributed to macOS users through a malvertising campaign that abused Google search ads and impersonated **Slack**. Victims who clicked the ads were redirected through intermediary sites to a fake Slack-themed download page, where macOS users received a malicious DMG carrying the stealer, while Windows users were served a **FakeBat** payload, showing a cross-platform delivery operation. Researchers reported that the malware had been refreshed in late 2023 with added obfuscation designed to conceal strings, payload components, and command-and-control details from defenders. Once launched on macOS, Atomic Stealer prompted victims for their system password and harvested browser data, saved credentials, cookies, cryptocurrency wallet information, and other sensitive files before exfiltrating the data to its operators. Separate analysis of the malware family has documented its focus on stealing high-value user data from Apple systems, while reporting around the campaign also tied the operation to a **malware-as-a-service** model promoted on Telegram, including discounted access offers that highlighted the commercialized nature of the threat.
Aug 15, 2026