Ankura CTIX FLASH Update - September 23, 2025

Malware Activity

AI-Enhanced Malware Campaigns and Fake Repository Attacks on macOS

Cybersecurity experts have raised alarms over a widespread campaign targeting macOS users through counterfeit GitHub repositories that distribute malware disguised as legitimate applications like 1Password, Dropbox, and Notion. These repositories utilize SEO poisoning strategies to achieve high rankings in search engine results, luring users to click on links that promise to assist in installing tools like LastPass. However, these links ultimately redirect to GitHub pages operated by multiple accounts to avoid removal by authorities. Users are prompted to run commands in Terminal, resulting in the deployment of the Atomic infostealer malware. This campaign exemplifies a persistent threat landscape where malicious actors utilize compromised or fake repositories, leveraging popular search engines and hosting platforms to disseminate malware and steal sensitive data. Additionally,