A malware campaign targeting macOS users uses typosquatted domains impersonating the Homebrew package manager to trick victims into executing malicious commands. The attack delivers Cuckoo Stealer, a credential harvester that establishes persistence, bypasses Gatekeeper, and exfiltrates sensitive data including browser credentials and cryptocurrency wallets.