Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix | macOS Threat Hunting Analysis

A malware campaign targeting macOS users uses typosquatted domains impersonating the Homebrew package manager to trick victims into executing malicious commands. The attack delivers Cuckoo Stealer, a credential harvester that establishes persistence, bypasses Gatekeeper, and exfiltrates sensitive data including browser credentials and cryptocurrency wallets.

• Infostealer riding the AI TrainMalware2026-10-23
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21
• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• Active Exploitation of CVE-2026-110936 in Siemens Software CenterExploitedCampaign2026-10-20
• "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesCampaign2026-10-21