---
title: Hackers Target Mac Users with Fake Homebrew Installation Sites
description: Fake Homebrew sites target macOS users, adding hidden malicious code to clipboard during installation, posing a new supply chain threat.
canonical_url: https://codekeeper.co/ticker/fake-homebrew-sites-target-macos-users
---

# Hackers Target Mac Users with Fake Homebrew Installation Sites

Fake Homebrew sites target macOS users, adding hidden malicious code to clipboard during installation, posing a new supply chain threat.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 14, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals are targeting macOS users through fake Homebrew package manager websites that look identical to the real thing. The attackers created convincing replicas of brew.sh using domains like homebrewfaq.org and homebrewclubs.org. When users visit these spoofed sites to install Homebrew, hidden JavaScript code manipulates their clipboard without permission. Instead of copying just the legitimate installation command, the fake "Copy" button secretly adds malicious code that downloads additional payloads from attacker-controlled servers. The scam is particularly clever because it runs malicious commands in the background while the real Homebrew installation proceeds normally, making detection difficult. This represents a new twist on supply chain attacks by targeting the installation process rather than compromising official repositories. **Source:** [Cybersecurity News](https://cybersecuritynews.com/hackers-attacking-macos-users-with-spoofed-homebrew-websites/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffake-homebrew-sites-target-macos-users%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Software security Critical Flaw Let Any Website Run Code on Machines Used for SWIFT Oct 5, 2026](https://codekeeper.co/ticker/sconnect-vulnerability-swift-users-switch)

[FBI-Flagged Phishing Kit Kali365 Expands Beyond Microsoft 365 Aug 12, 2026](https://codekeeper.co/ticker/kali365-phishing-service-expands-targets)

[Cyberattacks McKesson Confirms Breach as ShinyHunters Claims 284 Million Records Sep 7, 2026](https://codekeeper.co/ticker/mckesson-cyberattack-shinyhunters-data-breach)

[Cyberattacks Engineer Gets 32 Months for Ransoming His Own Employer Oct 12, 2026](https://codekeeper.co/ticker/kansas-city-man-jailed-for-bitcoin-ransom-scheme)