LastPass: Fake password managers infect Mac users with malware

LastPass is warning users of a campaign that targets macOS users with malicious software impersonating popular products delivered through fraudulent GitHub repositories. The fake apps deliver the Atomic (AMOS) info-stealing malware in ClickFix attacks, and are promoted through search engine optimization (SEO) tactics on Google and Bing. AMOS is a malware-as-a-service operation available for $1,000/month that typically targets data on infected machines. Recently, the developers of the malware added a backdoor component, giving attackers persistent, stealthy access to compromised systems. LastPass says that apart from its product, the campaign impersonates more than 100 software solutions, like 1Password, Dropbox, Confluence, Robinhood, Fidelity, Notion, Gemini, Audacity, Adobe After Effects, Thunderbird, and SentinelOne. The attackers created a large number of deceptive GitHub repositories from multiple accounts to evade takedown and optimize them to rank high in search results. These repositories feature a “download button” that directs visitors to a secondary site, where they are prompted to paste a command into the Terminal to perform the installation. This is a typical ‘ClickFix’ attack that takes advantage of the victim not understanding what the command does on their system. The command performs a curl request to a base64-encoded URL and downloads an AMOS payload (install.sh) to the /tmp directory. ClickFix attacks targeting Apple computers aren’t rare. BleepingComputer...