{"id":"CMP-202610-fake-grapheneos-download-site-installgarphenos-ink-serves-ma","kind":"campaign","aliases":[],"related":[],"title":"Fake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zip","description":null,"summary":"A lookalike GrapheneOS domain, installgarphenos[.]ink (note the misspelling 'garphenos'), offers a download at /GrapheneOS.zip that contains macOS malware, according to MalwareHunterTeam (2026-10-28). The sample was uploaded to MalwareBazaar by researcher smica83. Anyone looking for GrapheneOS install tooling on a Mac is at risk, including developers and security staff who flash phones from a work Mac. The malware family, what it steals, how traffic reaches the site (search ads, SEO or links) and when the domain went live are unknown. Seen since 2026-10-28.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-28T22:38:34+00:00","products":[{"name":"macOS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"GrapheneOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning","macos","malware","typosquat"],"not_affected_if":[],"how_to_check":"- Search DNS, proxy and EDR logs for the domain installgarphenos[.]ink and for downloads of GrapheneOS.zip from any host other than grapheneos.org.\n- On Macs, look for a GrapheneOS.zip in ~/Downloads, or an app taken out of it, that did not come from grapheneos.org.\n- File hashes and the malware family: unknown in the sources (the sample is on MalwareBazaar).","fix":"- Block installgarphenos[.]ink at DNS and the web proxy.\n- Install GrapheneOS only from grapheneos.org, using its official web installer or CLI install guide.\n- If a Mac opened GrapheneOS.zip from this domain, treat it as compromised: isolate it, rotate passwords, browser sessions and keys used on it from another device, and reimage it.","status":"open","published_at":null,"first_seen_at":"2026-10-28T22:38:34+00:00","triaged_at":"2026-10-28T22:38:34+00:00","updated_at":"2026-10-28T22:38:34+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':55B,117B '-202610':13A '-28':56B,118B '/grapheneos.zip':46B '2026':54B,116B 'accord':51B 'ad':102B 'anyon':66B 'campaign':25B 'cmp':12A 'contain':48B 'develop':79B 'domain':35B,109B 'download':3A,17A,44B 'earli':27B 'early-warn':26B 'fake':1A,15A 'fake-grapheneos-download-site-installgarphenos-ink-serves-ma':14A 'famili':92B 'flash':84B 'garpheno':41B 'grapheneo':2A,34B,69B 'grapheneos':16A,24A 'grapheneos.zip':11A 'includ':78B 'ink':6A,20A,37B 'instal':70B 'installgarpheno':5A,36B 'installgarphenos':19A 'link':105B 'live':111B 'look':67B 'lookalik':33B 'ma':22A 'mac':8A,74B,89B 'maco':29B,49B 'macos':23A 'malwar':9A,30B,50B,91B 'malwarebazaar':62B 'malwarehunterteam':53B 'misspel':40B 'note':38B 'offer':42B 'phone':85B 'reach':98B 'research':64B 'risk':77B 'sampl':58B 'search':101B 'secur':81B 'seen':114B 'seo':103B 'serv':7A 'serves':21A 'sinc':115B 'site':4A,18A,100B 'smica83':65B 'staff':82B 'steal':95B 'tool':71B 'traffic':97B 'typosquat':31B 'unknown':113B 'upload':60B 'warn':28B 'went':110B 'work':88B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:10:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-fake-grapheneos-download-site-installgarphenos-ink-serves-ma","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-28T22:38:34+00:00","fetched_at":"2026-10-28T22:38:34+00:00","note":null}],"documents":[{"id":12709,"url":"https://x.com/malwrhunterteam/status/2115566967851782394","title":"@malwrhunterteam: Totally not a malicious @GrapheneOS faking domain: installgarphenos[.]ink\n😂\n🤷‍♂️","kind":"post","source":"x","text":"Totally not a malicious @GrapheneOS faking domain: installgarphenos[.]ink\n😂\n🤷‍♂️ https://t.co/2LAC6zqzga\n\nlikes 6 reposts 5","published_at":"2026-10-28T22:10:45+00:00","relation":"describes","confidence":null,"note":null},{"id":12708,"url":"https://x.com/malwrhunterteam/status/2115567707026538849","title":"@malwrhunterteam: @GrapheneOS Totally not some boring Mac malware coming from here: https://instal","kind":"post","source":"x","text":"@GrapheneOS Totally not some boring Mac malware coming from here: https://installgarphenos[.]ink/GrapheneOS.zip\n😂\n🤷‍♂️ https://t.co/zec4zXNgg3\n\nlikes 1 reposts 0","published_at":"2026-10-28T22:13:41+00:00","relation":"describes","confidence":null,"note":null},{"id":12713,"url":"https://x.com/malwrhunterteam/status/2115568654347911610","title":"@malwrhunterteam: @GrapheneOS And @smica83 uploaded the sample coming from that url to Bazaar: htt","kind":"post","source":"x","text":"@GrapheneOS And @smica83 uploaded the sample coming from that url to Bazaar: https://t.co/Ga5YPqQoor\n\nlikes 0 reposts 0","published_at":"2026-10-28T22:17:27+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}