---
id: "CMP-202610-fake-grapheneos-download-site-installgarphenos-ink-serves-ma"
kind: "campaign"
aliases: []
title: "Fake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zip"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "macOS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "GrapheneOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning", "macos", "malware", "typosquat"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-28T22:38:34+00:00"
updated_at: "2026-10-28T22:38:34+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-28T22:38:34+00:00"}]
---

# Fake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zip

A lookalike GrapheneOS domain, installgarphenos[.]ink (note the misspelling 'garphenos'), offers a download at /GrapheneOS.zip that contains macOS malware, according to MalwareHunterTeam (2026-10-28). The sample was uploaded to MalwareBazaar by researcher smica83. Anyone looking for GrapheneOS install tooling on a Mac is at risk, including developers and security staff who flash phones from a work Mac. The malware family, what it steals, how traffic reaches the site (search ads, SEO or links) and when the domain went live are unknown. Seen since 2026-10-28.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:macOS affected ? fixed ?
- vendor:GrapheneOS affected ? fixed ?

## How to check

- Search DNS, proxy and EDR logs for the domain installgarphenos[.]ink and for downloads of GrapheneOS.zip from any host other than grapheneos.org.
- On Macs, look for a GrapheneOS.zip in ~/Downloads, or an app taken out of it, that did not come from grapheneos.org.
- File hashes and the malware family: unknown in the sources (the sample is on MalwareBazaar).

## Fix

- Block installgarphenos[.]ink at DNS and the web proxy.
- Install GrapheneOS only from grapheneos.org, using its official web installer or CLI install guide.
- If a Mac opened GrapheneOS.zip from this domain, treat it as compromised: isolate it, rotate passwords, browser sessions and keys used on it from another device, and reimage it.

## Timeline

- 2026-10-28T22:38:34+00:00 analyst

## Documents

- [describes] @malwrhunterteam: Totally not a malicious @GrapheneOS faking domain: installgarphenos[.]ink
😂
🤷‍♂️ https://x.com/malwrhunterteam/status/2115566967851782394
- [describes] @malwrhunterteam: @GrapheneOS Totally not some boring Mac malware coming from here: https://instal https://x.com/malwrhunterteam/status/2115567707026538849
- [describes] @malwrhunterteam: @GrapheneOS And @smica83 uploaded the sample coming from that url to Bazaar: htt https://x.com/malwrhunterteam/status/2115568654347911610

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_