LastPass Warns of Faux Repositories Infecting macOS with Atomic Infostealer

Sep 20, 2025Ravie LakshmananSoftware program Safety / Malware

LastPass is warning of an ongoing, widespread data stealer marketing campaign concentrating on Apple macOS customers via faux GitHub repositories that distribute malware-laced applications masquerading as authentic instruments.

“Within the case of LastPass, the fraudulent repositories redirected potential victims to a repository that downloads the Atomic infostealer malware,” researchers Alex Cox, Mike Kosak, and Stephanie Schneider from the LastPass Risk Intelligence, Mitigation, and Escalation (TIME) crew stated.

Past LastPass, a few of the common instruments impersonated within the marketing campaign embrace 1Password, Basecamp, Dropbox, Gemini, Hootsuite, Notion, Obsidian, Robinhood, Salesloft, SentinelOne, Shopify, Thunderbird, and TweetDeck, amongst others. All of the GiHub repositories are designed to focus on macOS methods.

The assaults contain using Search Engine Optimization (search engine optimization) poisoning to push hyperlinks to malicious GitHub websites on prime of search outcomes on Bing and Google, that then instruct customers to the obtain this system by clicking the “Set up LastPass on MacBook” button, redirecting them a GitHub web page area.

“The GitHub pages seem like created by a number of GitHub usernames to get round takedowns,” LastPass stated.

The GitHub web page is designed to take the consumer to a different area that gives ClickFix-style directions to repeat and execute a command on the Terminal app, ensuing within the deployment of the Atomic Stealer malware.

It is value noting comparable campaigns have been beforehand leveraged malicious sponsored Google Adverts for Homebrew to distribute a multi-stage dropper via a bogus GitHub repository that may run detect digital machines or evaluation environments, and decode and execute system instructions to ascertain reference to a distant server, per safety researcher Dhiraj Mishra.

In latest weeks, risk actors have been noticed leveraging public GitHub repositories to host malicious payloads and distribute them through Amadey, in addition to make use of dangling commits equivalent to an official GitHub repository to redirect unwitting customers to malicious applications.