Live › campaign › CMP-202611-afssju

medium⚡ Early warning · no CVE yetOther

Fake iCollections for macOS download site on GitHub Pages (icollections.github[.]io) serves a malicious DMG

Researcher MalwareHunterTeam reported on 2026-11-03 a site titled 'iCollections 9.7.2 for macOs' at icollections.github[.]io. Its 'Start download' button serves iCollections_9.7.2.dmg, which the researcher identifies as malware. iCollections is a real Mac desktop-organizer app, and this site is not the official one. The malware family, what it steals and how people are pushed to the site (search ads, links) are unknown. Since when: unknown, first reported 2026-11-03.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

medium

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Nov 3, 2026 UTC
Last modified: Nov 3, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-11-03 20:59 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
iCollections	macOS	–	–

Who cares: campaign, early-warning
Not affected if: –

How to check

Look for visits to icollections.github[.]io or downloads of iCollections_9.7.2.dmg (URL https://icollections.github[.]io/iCollections_9.7.2.dmg) in browser history, proxy/DNS logs or ~/Downloads
Treat any iCollections installer that did not come from the official vendor site or the Mac App Store as suspect

The fix

Block icollections.github[.]io
If the DMG was opened and run, treat the Mac as compromised: isolate it, remove the app, check LaunchAgents/LaunchDaemons, and from a clean device change saved browser and keychain passwords, revoke sessions and move crypto wallet funds
Install iCollections only from the official vendor site or the Mac App Store

Know the next one before it finds you.

Get started free

Live › campaign › CMP-202611-afssju

medium⚡ Early warning · no CVE yetOther

Fake iCollections for macOS download site on GitHub Pages (icollections.github[.]io) serves a malicious DMG

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

medium

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Nov 3, 2026 UTC
Last modified: Nov 3, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-11-03 20:59 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
iCollections	macOS	–	–

Who cares: campaign, early-warning
Not affected if: –

How to check

Look for visits to icollections.github[.]io or downloads of iCollections_9.7.2.dmg (URL https://icollections.github[.]io/iCollections_9.7.2.dmg) in browser history, proxy/DNS logs or ~/Downloads
Treat any iCollections installer that did not come from the official vendor site or the Mac App Store as suspect

The fix

Block icollections.github[.]io
If the DMG was opened and run, treat the Mac as compromised: isolate it, remove the app, check LaunchAgents/LaunchDaemons, and from a clean device change saved browser and keychain passwords, revoke sessions and move crypto wallet funds
Install iCollections only from the official vendor site or the Mac App Store

Know the next one before it finds you.

Get started free

Fake iCollections for macOS download site on GitHub Pages (icollections.github[.]io) serves a malicious DMG

Who is affected

How to check

The fix

Know the next one before it finds you.

Fake iCollections for macOS download site on GitHub Pages (icollections.github[.]io) serves a malicious DMG

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

Sources