How do I check whether I am affected by CMP-202610-fake-grapheneos-download-site-installgarphenos-ink-serves-ma?

- Search DNS, proxy and EDR logs for the domain installgarphenos[.]ink and for downloads of GrapheneOS.zip from any host other than grapheneos.org. - On Macs, look for a GrapheneOS.zip in ~/Downloads, or an app taken out of it, that did not come from grapheneos.org. - File hashes and the malware family: unknown in the sources (the sample is on MalwareBazaar).

Live › campaign › CMP-202610-fake-grapheneos-download-site-installgarphenos-ink-serves-ma

Go to dashboard

medium⚡ Early warning · no CVE yetExploited in the wildOther

Fake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zip

Q: What is the fix for CMP-202610-fake-grapheneos-download-site-installgarphenos-ink-serves-ma?

- Block installgarphenos[.]ink at DNS and the web proxy. - Install GrapheneOS only from grapheneos.org, using its official web installer or CLI install guide. - If a Mac opened GrapheneOS.zip from this domain, treat it as compromised: isolate it, rotate passwords, browser sessions and keys used on it from another device, and reimage it.

A lookalike GrapheneOS domain, installgarphenos[.]ink (note the misspelling 'garphenos'), offers a download at /GrapheneOS.zip that contains macOS malware, according to MalwareHunterTeam (2026-10-28). The sample was uploaded to MalwareBazaar by researcher smica83. Anyone looking for GrapheneOS install tooling on a Mac is at risk, including developers and security staff who flash phones from a work Mac. The malware family, what it steals, how traffic reaches the site (search ads, SEO or links) and when the domain went live are unknown. Seen since 2026-10-28.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

medium

no CVSS yet; severity from the sources

known so far4 of 6

missing: versions, primary source

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 22:38 UTC. All times on this page are UTC.

Who is affected

2 products

Product	Ecosystem	Affected	Fixed in
macOS	vendor	–	–
GrapheneOS	vendor	–	–

Who cares: campaign, early-warning, macos, malware, typosquat
Not affected if: –

How to check

Search DNS, proxy and EDR logs for the domain installgarphenos[.]ink and for downloads of GrapheneOS.zip from any host other than grapheneos.org.
On Macs, look for a GrapheneOS.zip in ~/Downloads, or an app taken out of it, that did not come from grapheneos.org.
File hashes and the malware family: unknown in the sources (the sample is on MalwareBazaar).

The fix

Block installgarphenos[.]ink at DNS and the web proxy.
Install GrapheneOS only from grapheneos.org, using its official web installer or CLI install guide.

Know the next one before it finds you.

Add to Slack

Live › campaign › CMP-202610-fake-grapheneos-download-site-installgarphenos-ink-serves-ma

Go to dashboard

medium⚡ Early warning · no CVE yetExploited in the wildOther

Fake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zip

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

medium

no CVSS yet; severity from the sources

known so far4 of 6

missing: versions, primary source

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 22:38 UTC. All times on this page are UTC.

Who is affected

2 products

Product	Ecosystem	Affected	Fixed in
macOS	vendor	–	–
GrapheneOS	vendor	–	–

Who cares: campaign, early-warning, macos, malware, typosquat
Not affected if: –

How to check

Search DNS, proxy and EDR logs for the domain installgarphenos[.]ink and for downloads of GrapheneOS.zip from any host other than grapheneos.org.
On Macs, look for a GrapheneOS.zip in ~/Downloads, or an app taken out of it, that did not come from grapheneos.org.
File hashes and the malware family: unknown in the sources (the sample is on MalwareBazaar).

The fix

Block installgarphenos[.]ink at DNS and the web proxy.
Install GrapheneOS only from grapheneos.org, using its official web installer or CLI install guide.

Know the next one before it finds you.

Add to Slack

Fake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zip

Who is affected

How to check

The fix

Know the next one before it finds you.

Fake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zip

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

Sources