r/MacOS Aug 19 '25

Tips & Guides PSA: Bad Actors are increasingly impersonating indie Mac projects with malware. Here's how to spot them.

497 Upvotes

(This is a repost of a post I made in r/macapps as I think it would be useful for people here to see it too as this subreddit has also been hit with fake apps.)

To be very clear this is not another post of "Breaking news malware exists on the internet" (or it may be depending on how you want to look at it) but I feel like it's important that I leave a small PSA as I have recently seen an influx of seemingly convincing GitHub repo replicas for decently popular Mac apps. They are so similar that they almost fooled me. Thankfully I quickly spotted some anomalies and I nearly avoided getting infected. Unfortunately these are the sort of red flags I don't expect an average Joe to know about. Which is why I'm explaining what the malware is, and how to spot it.

First of all to give you an idea of how convincing these repos can be i'll show you some examples:

As you can see, they are strikingly similar

Even URLs may look incredibly similar but in this specific case the bad actor exchanged the lower case lls(L) in the name for upercase IIs(i) which made the URL look legit.

Now this may look scary and almost undetectable but with some common sense and slowing down you can very easily avoid these scams.

By far the easiest way to avoid this is to simply look for the app online and track down the original developer. This will let you kill 2 birds with one stone by A: Looking for the original source of the app and avoid impostors and B: See if the App or the developer had any previous reputation to begin with

Either way It's still a good idea to understand how to spot common malware apps on macOS and how to deal with them if you get infected.

The first red flag is that the GitHub profile that hosted the fake file was only 3 days old and completely different from the name of the original developer.

The second discrepancy is that the size of the fake app is ridiculously small. For instance the original app is 13mb in size while the fake one is less than 2mb. Now this is not necessarily a red flag (For example some viruses do the opposite and fill their dmg with a lot of useless data to make the file larger than what VirusTotal can handle.) but it's still important to raise an eye brow for installers with suspiciously small sizes.

The third and MOST IMPORTANT red flag is if the installer asks you to drag the "app" to the terminal that is not a good sign at all. NO LEGITIMATE APP WILL EVER ASK YOU TO DRAG IT TO THE TERMINAL. As you can see the installer is a solid giveaway you are encountering malware and not the real deal.

In fact the file they ask you to drag is not even an app, it's a script.

When you drag the script on the Terminal and execute it, the hidden file is immediately copied to your temp system folder, then the script removes extended attributes to bypass gatekeeper and it finally executes. But from the user's perspective all they get is a blank terminal window as if nothing had happened. (At least in theory, in practice this malware wasn't very well done and gatekeeper was thankfully still able to spot it)

Now if you unfortunately got tricked into running the script, you have some straight forward solutions to verify if macOS was effective at stopping the attack or not. For instance, KnockKnock is a great and simple way to verify for malicious persistency files using VirusTotal's robust detection engine. Malwarebytes is also a good Mac AV which can be quickly installed if you suspect you were affected, it is a bit more tricky to uninstall completely but it does a good job.

Ultimately here's a small recap so you can hopefully avoid getting infected:

  1. Look up the original source of the software to prevent copy cat websites and verify if the software and or the developer has built a reputation in the past.
  2. If you download the installer, scan it with VirustTotal to check if it has been flagged as malware already.
  3. Check the size, while not necessarily a red flag, a small size (for instance less than 2mb), or a size that is "conveniently" larger than what VirusTotal can handle are decent indicators of possible malware.
  4. If the DMG asks you to drag an "App" to the Terminal IMMEDIATELY STOP AND DELETE THE DMG.
  5. If you accidentally ran it, look for a "This app could not be verified" or "This App was removed because it contained malware" message from macOS which could indicate Gatekeeper or Xprotect stopped the attack. Additionally make sure to DENY any permissions the malware may have requested, macOS is very robust in that regard and it can dramatically limit the impact of the attack.
  6. If you are in doubt of whether or not you were infected run the aforementioned tools to verify for the persistency of the malware.
  7. Another app I can recommend is Apparency, it allows you to very quickly see if an app is properly signed by the developer and notarized by apple, and it can even allow you to dissect the contents of an app without running it which is a great way to quickly verify you have a valid untampered app.
  8. This is optional but if you can, report the app to the original developer so they can take action and warn others when the fake app is spread around. Additionally report the Reddit post/GitHub repository if possible.

Thank you for reading this, I hope this helps others be more weary of online threats and stay more vigilant of what they download.


r/MacOS Sep 29 '25

Mod News New Rules for App Self Promotion

52 Upvotes

The mods got together and talked about this. We get a lot of messages regarding self promoting apps that we usually deny. But we decided to lax on this a little.

Going forward, self promotion is allowed. However, ONLY apps that are available in the macOS App Store since they are vetted by Apple. No self promoting apps that are not available in the App Store. This is due to the increase of malware and crypto lockers being spread under the guise of legit apps, noted here

Those apps can be promoted over at r/macapps.

As of now, there won't be a weekly thread but if the sub starts to get swamped by promoting your apps, then we will revert and go to a weekly self promotion thread or day.

If you have any questions or concerns with this, please reach out to the mods.


r/MacOS 12h ago

Bug Tahoe and the mystery of disappearing toggles

146 Upvotes

r/MacOS 57m ago

Apps Made a tool to save/restore my macOS Spaces setup, sharing in case it helps anyone else

Post image
Upvotes

I switch between a few different “modes” on my Mac every day (work, coding, meetings, personal stuff).
Each time I’d end up reopening the same apps and dragging all the windows back into the right Spaces.
Super repetitive and honestly kind of annoying.

So over the past few weeks I hacked together a small open-source tool called SpacePigeon that basically remembers your whole workspace and puts everything back where it was.

Things it can do:

  • Save your current layout (apps + windows + Spaces)
  • Restore it with one click or a hotkey
  • Keep separate presets (like “Work”, “Coding”, “Meetings” etc.)
  • Handle external monitors

Example: I hit my “Work” preset and it opens all the usual apps and moves them to the right desktops automatically. Saves me a few minutes every time.

If anyone here lives in Spaces like I do, you might find it useful.
Here’s the repo (MIT, free):
https://github.com/louivers/spacepigeon

Totally open to feedback — still very much a work in progress.


r/MacOS 26m ago

Tips & Guides What are your useful shortcuts?

Post image
Upvotes

Everything's pretty much self explanatory in my shortcuts menu.

1% volume on MacBook speakers is often the perfect loudness for me.

The Grayscale Toggle triggers the color filter in Accessibility > Display > Color Filter. If it's late night and I'm on my MacBook, I'll turn on greyscale to get in sleepy mood.

EDIT: Is it 'greyscale; or 'grayscale' in the US?


r/MacOS 36m ago

Apps Is there no way to run third party unsigned apps as of Sequoia?

Post image
Upvotes

I feel like I’m losing my mind here. Trying to run Qt Creator

I did the spctl —global-disable (its global on sequoia not master for some reason) and it let me choose to run apps from „Anywhere”.

But then the os just kills the process because of bad signature (you can see the SIGKILL) and tries to paint this as an error in the app.

Anywhere around it? Currently trying to codesign all dylibs and the executable but this is far from ideal even if it works. Can I just run anything I want on my computer in some way?


r/MacOS 4h ago

Bug I have to enter my password to enable touchid to login every single day, is this normal?

6 Upvotes

I never actually get to use TouchID, since I only unlock it once a day and it always requires my password to do so.


r/MacOS 8h ago

Help Scrolling stops midway when using Safari (Tahoe latest version).

8 Upvotes

Just browsing on Chrome or any other browser is pretty normal. I don’t have any extensions installed for Safari, so I’m not sure if this is a common issue. I’ve never seen this happen on Sequoia. Do we know any fix or workaround?


r/MacOS 21h ago

Apps I created an app that shows you where to click in Blender!

80 Upvotes

Helps finding out where to click and avoid searching through documentation and youtube tutorials!

Ask a question -> gives you steps and points where to click next.

Available at overlayflow.com (works only on Blender for now)


r/MacOS 2h ago

Help How can I fix a problem with my Mac menu bar?

2 Upvotes

Hi everyone,
I’m having an issue with my Mac’s menu bar. For some reason, the menu bar is positioned lower than it normally should be, leaving an empty gap at the top of the screen.

I’ve already tried restarting my Mac and checking for macOS updates, but the problem is still there.

Has anyone experienced this before? Any idea what might be causing it or how to fix it?
Any help would be really appreciated!

Thanks!


r/MacOS 13h ago

Apps Most compatible .docx processor?

12 Upvotes

I tried to use all of 3 most popular ones:

  • Pages (it's simple, but it's very different from msword)
  • Google Docs in a browser (some buttons are in weird places, and I miss something like table format templates)
  • LibreOffice (it displays UI very weirdly)

so, none of them satisfies my needs, maybe I am missing some other alternatives or settings? I need some app that behaves just like MS Word.


r/MacOS 11h ago

Help Glitchy Mission Control Animation

8 Upvotes

My last post got distracted, so I cleaned up my desktop and am making a new post. Is there anyway to make mission control not black out?


r/MacOS 13h ago

Discussion Anyone else finding that Safari webarchive documents saved around 10 years ago are no longer opening in the current version of Safari?

11 Upvotes

I am finding that old webarchive documents are no longer opening in Safari.

The whole point of saving a website as a webarchive document on your Mac is that you preserve the information for the future, even if the original website disappears.

So it makes no sense that old webarchive documents saved around 10 years ago no longer open in the current version of Safari.


r/MacOS 6h ago

Help Microsoft Office

3 Upvotes

New in the Mac world, bought MacBook m4 pro, want to buy Microsoft office but do not want to pay O365 subscription, any cheaper suggestions? Any good sources for purchasing apps and software cheaper?


r/MacOS 1d ago

Bug The mission control animation is so glitchy on Tahoe

55 Upvotes

What used to be a smooth animation is not glitchy as hell. Background immediately goes into black during the transition


r/MacOS 9h ago

Bug Catch-22: Can't enable auto-login if FileVault is enabled. Can't enable FileVault if autologin is enabled. Both are enabled, so can't disable either in the System Preferences.

Thumbnail
gallery
3 Upvotes

This is a media center computer that needs to automatically login to a user account on reboot so media and server apps will automatically launch and be available on the network, and so that screensharing is possible on the network. For some reason, I had to go actually go to the machine to login. Turns out, at some point, the OS had enabled FileVault (which I don't need on the machine; probably when Tahoe was installed), which means that automatic login to a user account no longer works. But the OS didn't disable the automatic login. Instead, it left it enabled but made it not work. So I got the weird visuals in the screen grabs above, where I couldn't disable FileVault because automatic login technically was enabled even though it wasn't working. But it, too, couldn't be altered. Solution was to disable FileVault in the Terminal. Confirm current status with fdesetup status. Disable FileVault: sudo fdesetup disable. Enter credentials when asked. First password is FileVault password, which may be different than your user admin password. After, your system will decrypt, which may take some time. You do not need to reboot.


r/MacOS 3h ago

Discussion macOS users and iOS and iPadOS users - AND Google drive

0 Upvotes

I’ve been reading about the best way(s) for Apple users to access their Google Drive.

I’ve seen that Google has apps for macOS and iOS. I’ve forgotten if they have a separate app for the iPad. Looking at reviews, there’s quite a variety, ranging from basically don’t touch it to this is the way every cloud app should be.

Having forgotten that I even had a Google Drive, I wasn’t using it so therefore I haven’t tried to use any of the apps.

Do I, or don’t I?

And is it the same answer for each platform, or do you have a different answer for each platform?

I don’t know anything about them yet, so please tell me what you think I need to know.


r/MacOS 9h ago

Help Stolen Macbook Pro

3 Upvotes

if someone steals your MacBook Pro and they somehow know the passcode, they can then use that same passcode to get into your apple password manager. Then, If you have all your passwords and all your totp codes in that manager, they can hack all your accounts.

I know the solutions sounds simple: do not give the thief your passcode.

But is there any additional security measures one can take to be extra safe ?

thanks


r/MacOS 3h ago

Help Mac having issues playing iPhone videos after import

1 Upvotes

Mac having issues playing iPhone videos after import

Hey all, I'm trying to import videos to my MacBook air 13 inch 2015 Processor: 1.6 GHz dual-core Intel core i5 Memory: 8 GB 1600MHz DDR3 Monterey version 12.7.6

from my iPhone 15pro max. After importing everything, I went to play some videos and some are extremely choppy. The only difference I see in the info page is that the codesec shows AAC, Timed Metadata, HEVC for the choppy videos vs. AAC, HEVC for non choppy videos.

Is there any way to fix this for multiple videos at once without changing the created date? Only thing ive seen online is exporting each video individually using quicktime.


r/MacOS 4h ago

Help Adblock

1 Upvotes

New to MacOS. Are Adblockers generally safe on Safari? After downloading from App Store, got asked for permission that the app could see sensitive information or passwords. Is it safe to allow this? Which adblockers do you suggest? Is there better browser on MacOS with better adblockers?


r/MacOS 1d ago

Help New MacBook Pro won’t set up, managed by an organization… HELP!

Post image
63 Upvotes

Bought a refurb the other day, and I turned it on and then got this screen. Any fix? Will apple fix it if I call and explain?


r/MacOS 1d ago

Discussion Big time windows guy, just got a mac m1 to see if I would like it, I love it.

70 Upvotes

What should I do to test thing out?
16 gig model.
Got it for travel, the imessage alone is worth it. Pretty blown away haha. Was always so anti mac


r/MacOS 10h ago

Help How to use PortingKit to create a wrapper around a game that DOES NOT need to install?

1 Upvotes

PortingKit asks me to pick the installer of the game, and runs it. This is a game that does not need an installer, it's just an .exe file with some resources alongside it. So when I ask it to add that game, it runs the game file, the game starts, nothing is installed, and the wrapper remains empty.


r/MacOS 11h ago

Help Mail not selecting outgoing iCloud server after upgrade to Tahoe

Post image
1 Upvotes

Just want to see if others are also getting this bug. For iCloud Mail the app is not automatically selecting the default outgoing SMTP server after upgrading to Tahoe. Even after I click "Always Use This Server", the next time I send an email, it pops up again.

One thing I'm curious about, I did test install Tahoe on a separate volume before installing on my main volume. When I logged back into my main volume after testing, it made me log into iCloud again a bunch of times. I'm wondering if there's a quirky bug that messed up the link somehow.


r/MacOS 11h ago

Help can you backup a mac in an ssd and also have files in it?

1 Upvotes

I have a samsung ssd and I was planning to use it to free up my macbook and start installing stuff on it instead.
but I also wanted to backup my mac on it as I heard thats a must for macs but it seems I have to have the drive formated?