Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled session for the attacker.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re on a GitHub-looking page, dark theme, Octocat, even a “Verified Publisher” badge… and it says: Download for macOS. But instead of a normal app download, the page tells you: open Terminal, paste this command, then enter your Mac password. That’s the AmnesiaStealer trick, real malware from a fake GitHub download flow. Once you run it, a hidden script pulls a password-protected ZIP, drops malware, and starts raiding Keychain, browser data, Apple Notes, Telegram sessions, even turning your Chromium browser into a remotely controlled session using your cookies. If any website tells you to paste a command into Terminal and type your Mac password, stop right there and report it to security, treat it as a high‑risk scam.
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Attackers took over the verified official HBO Max Reddit account and used it to run a 48-hour wave of malicious ads. The ads sent people to lookalike download sites that tricked them into copying and running commands, leading to information-stealing malware on both macOS and Windows. Researchers…
A macOS info-stealing malware called ClickLock Stealer uses a fake “Cloudflare verification” page to trick users into copying and running a Terminal command. It then steals browser, crypto wallet, and Keychain data and sends it to attackers via a Telegram bot, while killing processes to hide…
Researchers reported two China-linked groups targeting NGOs with spear-phishing that led victims through a legitimate U.S. university website before redirecting them to attacker infrastructure. The attackers used a chained Chrome/Windows exploit to take control, then deployed different payloads,…
Anthropic reports multiple real-world threat groups used Claude to support cyber operations, including credential harvesting and data theft across many victims. The report includes specific, simulation-ready lures such as a fake ESET NOD32 login portal that sends stolen passwords to Telegram and a…
