{"id":"CMP-202611-afssju","kind":"campaign","aliases":[],"related":[],"title":"Fake iCollections for macOS download site on GitHub Pages (icollections.github[.]io) serves a malicious DMG","description":null,"summary":"Researcher MalwareHunterTeam reported on 2026-11-03 a site titled 'iCollections 9.7.2 for macOs' at icollections.github[.]io. Its 'Start download' button serves iCollections_9.7.2.dmg, which the researcher identifies as malware. iCollections is a real Mac desktop-organizer app, and this site is not the official one. The malware family, what it steals and how people are pushed to the site (search ads, links) are unknown. Since when: unknown, first reported 2026-11-03.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"iCollections","fixed":[],"ecosystem":"macOS"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for visits to icollections.github[.]io or downloads of iCollections_9.7.2.dmg (URL https://icollections.github[.]io/iCollections_9.7.2.dmg) in browser history, proxy/DNS logs or ~/Downloads. Treat any iCollections installer that did not come from the official vendor site or the Mac App Store as suspect.","fix":"Block icollections.github[.]io. If the DMG was opened and run, treat the Mac as compromised: isolate it, remove the app, check LaunchAgents/LaunchDaemons, and from a clean device change saved browser and keychain passwords, revoke sessions and move crypto wallet funds. Install iCollections only from the official vendor site or the Mac App Store.","status":"open","published_at":null,"first_seen_at":"2026-11-03T20:59:59+00:00","triaged_at":"2026-11-03T20:59:59+00:00","updated_at":"2026-11-03T21:01:57+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-03':30B,96B '-11':29B,95B '-202611':17A '2026':28B,94B '9.7.2':35B 'ad':85B 'afssju':18A 'app':61B 'button':44B 'campaign':20B 'cmp':16A 'desktop':59B 'desktop-organ':58B 'dmg':15A 'download':5A,43B 'earli':22B 'early-warn':21B 'fake':1A 'famili':72B 'first':92B 'github':8A 'icollect':2A,34B,53B 'icollections':19A 'icollections.github':10A,39B 'icollections_9.7.2.dmg':46B 'identifi':50B 'io':11A,40B 'link':86B 'mac':57B 'maco':4A,37B 'malici':14A 'malwar':52B,71B 'malwarehunterteam':25B 'offici':68B 'one':69B 'organ':60B 'page':9A 'peopl':78B 'push':80B 'real':56B 'report':26B,93B 'research':24B,49B 'search':84B 'serv':12A,45B 'sinc':89B 'site':6A,32B,64B,83B 'start':42B 'steal':75B 'titl':33B 'unknown':88B,91B 'warn':23B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["icollections"],"ptokens":["icollections"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"malware","first_public_at":"2026-11-03T19:56:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-afssju","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T20:59:59+00:00","fetched_at":"2026-11-03T20:59:59+00:00","note":null}],"documents":[{"id":60348,"url":"https://x.com/malwrhunterteam/status/2117707500837576826","title":"@malwrhunterteam: Some site titled \"iCollections 9.7.2 for macOs\": https://icollections.github[.]i","kind":"post","source":"x","publisher":null,"text":"Some site titled \"iCollections 9.7.2 for macOs\": https://icollections.github[.]io/\nThe \"Start download\" button gives something from here: https://icollections.github[.]io/iCollections_9.7.2.dmg\nYes, that given \"iCollections_9.7.2.dmg\" file is totally not a malware sample...\n😂\n🤷‍♂️ https://t.co/lw9TiJwffU\n\nlikes 5 reposts 1","published_at":"2026-11-03T19:56:27+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}