Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled session for the attacker.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re on a GitHub-looking page, dark theme, Octocat, even a “Verified Publisher” badge… and it says: Download for macOS. But instead of a normal app download, the page tells you: open Terminal, paste this command, then enter your Mac password. That’s the AmnesiaStealer trick, real malware from a fake GitHub download flow. Once you run it, a hidden script pulls a password-protected ZIP, drops malware, and starts raiding Keychain, browser data, Apple Notes, Telegram sessions, even turning your Chromium browser into a remotely controlled session using your cookies. If any website tells you to paste a command into Terminal and type your Mac password, stop right there and report it to security, treat it as a high‑risk scam.
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A macOS info-stealing malware called ClickLock Stealer uses a fake “Cloudflare verification” page to trick users into copying and running a Terminal command. It then steals browser, crypto wallet, and Keychain data and sends it to attackers via a Telegram bot, while killing processes to hide…
Researchers describe AmnesiaStealer, a macOS infostealer spread via a convincing fake GitHub download page that tricks users into pasting a Terminal command. After installation, it uses an “Installer”-style password prompt to capture the Mac login password, steal browser and keychain data, and can…
Researchers reported a real phishing campaign (“Operation BlueDash”) that tricks users with a “secure document” lure and routes them to a fake Microsoft Store page that claims Microsoft Teams must be updated. The download installs legitimate remote access tools (Level RMM and ScreenConnect) so…
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
