Fake Homebrew Sites Use ClickFix to Deliver Cuckoo Stealer on macOS

Feb 17, 2026 · Original article ↗

Summary

Researchers analyzed a macOS ClickFix campaign using typosquatted Homebrew pages to steal credentials and deliver Cuckoo Stealer, a persistent RAT that can collect sensitive data and execute commands.

Key points

Fake Homebrew pages silently copy a malicious curl command to users’ clipboards, leading them to download and run a script in Terminal.
The modified installer repeatedly prompts for a password and validates it with macOS Directory Services before downloading the second-stage payload.
Cuckoo Stealer installs a LaunchAgent, removes the downloaded file’s quarantine attribute, and uses encrypted HTTPS command-and-control to receive commands.
The malware can run shell commands, capture screenshots, browse and exfiltrate files, and remove its persistence and installation directory.
Targets include browser credentials and sessions, macOS Keychain data, Apple Notes, messaging sessions, VPN and FTP configurations, documents, and data from more than 20 cryptocurrency wallets.
Infrastructure hunting linked multiple Homebrew-impersonating domains to shared hosting and identified dozens of similar macOS-targeting pages.

Article Details

Attack Vectors: High-fidelity Homebrew impersonation pages on typosquatted domains persuade users to copy a malicious installation command into Terminal.
The installation command substitutes an attacker-controlled script host for the legitimate Homebrew distribution host and downloads and executes a modified installer through curl and bash.
The modified installer repeatedly requests a password and validates it with dscl authonly before downloading the second-stage binary and passing the Base64-encoded password as an argument.
Defensive Notes: The researchers hunted for pages containing curl commands, -fsSL flags, /install.sh references, and copy-to-clipboard functionality. These behavioral matches require investigation rather than automatically establishing maliciousness.
Infrastructure pivots used domain registration records, shared hosting, certificate history, and phishing detections to identify related delivery infrastructure.
Reported persistence artifacts include ~/Library/LaunchAgents/com.homebrew.brewupdater.plist, the label com.homebrew.brewupdater, and ~/.local-{session_id}/BrewUpdater.
The malware removes quarantine attributes, encrypts sensitive strings, and supports deleting its LaunchAgent and installation directory, complicating detection and forensic investigation.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`braw[.]sh`	Homebrew typosquat variant listed as malicious network infrastructure.
DOMAIN	`brew[.]lat`	Homebrew typosquat variant listed as malicious network infrastructure.
DOMAIN	`brewmacos[.]com`	Domain identified by the researchers among additional macOS ClickFix pages.
DOMAIN	`brewsh[.]cx`	Homebrew typosquat hosted on the shared malicious infrastructure.
DOMAIN	`brewshh[.]org`	Homebrew impersonation domain identified through the shared-infrastructure pivot.
DOMAIN	`brrewsh[.]org`	Homebrew impersonation domain identified through the shared-infrastructure pivot.
DOMAIN	`homabrews[.]org`	Homebrew impersonation domain used for payload delivery and identified in the IOC table as the primary C2 domain.
HOSTNAME	`bashbuddy-landing[.]pages[.]dev`	Cloudflare Pages hostname identified by the researchers as broader macOS ClickFix activity.
HOSTNAME	`brew[.]pages[.]dev`	Specific hosted Homebrew typosquat listed as malicious network infrastructure.
HOSTNAME	`raw[.]brewsh[.]cx`	Homebrew typosquat variant listed as malicious network infrastructure.
HOSTNAME	`raw[.]homabrews[.]org`	Attacker-controlled host serving the modified Homebrew installation script.
HOSTNAME	`www[.]nitrogen[.]lol`	Hostname identified by the researchers among additional macOS ClickFix pages.
IPV4	`5[.]255[.]123[.]244`	Shared malicious infrastructure hosting Homebrew typosquats; identified as shared C2 infrastructure.
SHA256	`545dd5cba264bf242bc837330ca34247e202f7ac25f03eec63bf5842357519f1`	Cuckoo Stealer hash listed in the file indicators.
SHA256	`f985cd667c77e7d99c1ac2ea9cb0861ded15e1c2d44e480cbd178ca8b2caae42`	Loader hash listed in the file indicators.
URL	`hxxps[:]//homabrews[.]org/brewinstaller`	Download URL for the second-stage binary named brew_agent.
URL	`hxxps[:]//raw[.]homabrews[.]org/Homebrew/install/HEAD/install[.]sh`	Malicious installer URL embedded in the fake Homebrew installation command.