Hackers Target macOS Users with Fake Homebrew Websites to Deliver Malicious Payloads

In September 2025, Kandji's security researchers identified a sophisticated cyber campaign involving multiple spoofed Homebrew installer sites that closely mimic the official brew.sh page.

These counterfeit domains delivered a hidden malicious payload disguised as the standard Homebrew installation script. The analysis focuses on the tactics, infrastructure, and impact of this security breach.

Package managers have increasingly become targets for supply-chain attacks. Homebrew, the most widely used package manager on macOS, had previously been unaffected by such compromises.

During the investigation, Kandji analysts discovered four malicious domains, such as homebrewoneline[.]org, resolving to the IP address 38[.]146[.]27[.]144. These domains presented accurate replicas of the Homebrew homepage but restricted text selection and copying within the install command block, directing users to use a single "Copy" button that inserted a manipulated command into the clipboard.

The spoofed sites contained embedded JavaScript that locked the installation instructions and altered the user's clipboard content. When the "Copy" button was clicked, the script executed the copyInstallCommand() function, adding a hidden command to the clipboard before the legitimate Homebrew install command.

Additionally, a fetch request was sent to notify.php to log metadata, such as click time and user environment. The code included Russian-language comments suggesting placeholders for base64-encoded payloads and possible exfiltration endpoints like Telegram.

The infrastructure also deployed the Odyssey Stealer, combining credential theft with persistent malware installation.

Screenshots of both the authentic Homebrew install page and its spoofed counterpart highlight the only visual difference: the absence of manual copy functionality.

This campaign highlights the need for macOS developers and administrators to consider supply-chain security for the tools managing packages. Users should verify install commands against trusted sources and avoid pasting shell snippets from unverified webpages.

Verification of the domain (brew.sh) and examining clipboard contents before command execution are crucial. Enterprise defenses should incorporate endpoint monitoring for unexpected fetch calls or base64-encoded payloads during installations.

Kandji Threat Intelligence is actively monitoring for new spoofed domains, maintaining a public repository of identified threats. Organizations can reduce exposure to this threat by integrating these IOCs into security tools and educating users on safe installation practices. As threats evolve, vigilance in verifying both package sources and installer sites remains essential.

Based on reporting by GBHackers.