{"id":"CMP-202611-bdenhj","kind":"campaign","aliases":[],"related":[],"title":"Fake Apple-looking download site apple.eu10hub[.]com serves Mac malware as SkyLawsInstaller.dmg","description":null,"summary":"Researcher MalwareHunterTeam reported on 7 Nov 2026 a macOS disk image named SkyLawsInstaller.dmg served from apple.eu10hub[.]com, a domain made to look like Apple, and flagged it as Mac malware. The malware family, how victims are sent to the link, who has been hit, and when the site went live are all unknown. A single researcher has shared the sample and URL; no vendor write-up yet.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"macOS","fixed":[],"vendor":"Apple"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Web/DNS/proxy logs for apple.eu10hub[.]com and any eu10hub[.]com subdomain, in particular the URL https://apple.eu10hub[.]com/get_file?file=91A2T8Ehs06E. On Macs, look in Downloads and mounted volumes for SkyLawsInstaller.dmg or an app installed from it. If someone forwards a message or link pointing to eu10hub[.]com, it is malicious.","fix":"Block eu10hub[.]com on DNS/proxy. Do not open SkyLawsInstaller.dmg. If it was opened and run, treat the Mac as compromised: isolate it, then from a clean device change passwords and sign out sessions for browser-saved accounts, the Apple ID and crypto wallets; reinstall macOS if you cannot rule out persistence.","status":"open","published_at":null,"first_seen_at":"2026-11-07T12:51:18+00:00","triaged_at":"2026-11-07T12:51:18+00:00","updated_at":"2026-11-07T12:52:25+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':15A '2026':28B '7':26B 'appl':3A,45B 'apple-look':2A 'apple.eu10hub':7A,37B 'bdenhj':16A 'campaign':18B 'cmp':14A 'com':8A,38B 'disk':31B 'domain':40B 'download':5A 'earli':20B 'early-warn':19B 'fake':1A 'famili':54B 'flag':47B 'hit':65B 'imag':32B 'like':44B 'link':61B 'live':71B 'look':4A,43B 'mac':10A,50B 'maco':30B 'macos':17A 'made':41B 'malwar':11A,51B,53B 'malwarehunterteam':23B 'name':33B 'nov':27B 'report':24B 'research':22B,77B 'sampl':81B 'sent':58B 'serv':9A,35B 'share':79B 'singl':76B 'site':6A,69B 'skylawsinstaller.dmg':13A,34B 'unknown':74B 'url':83B 'vendor':85B 'victim':56B 'warn':21B 'went':70B 'write':87B 'write-up':86B 'yet':89B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["macos"],"ptokens":["macos"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"malware","search_a":"'-202611':15A 'appl':3A 'apple-look':2A 'apple.eu10hub':7A 'bdenhj':16A 'cmp':14A 'com':8A 'download':5A 'fake':1A 'look':4A 'mac':10A 'macos':17A 'malwar':11A 'serv':9A 'site':6A 'skylawsinstaller.dmg':13A","search_b":"'2026':28B '7':26B 'appl':45B 'apple.eu10hub':37B 'campaign':18B 'com':38B 'disk':31B 'domain':40B 'earli':20B 'early-warn':19B 'famili':54B 'flag':47B 'hit':65B 'imag':32B 'like':44B 'link':61B 'live':71B 'look':43B 'mac':50B 'maco':30B 'made':41B 'malwar':51B,53B 'malwarehunterteam':23B 'name':33B 'nov':27B 'report':24B 'research':22B,77B 'sampl':81B 'sent':58B 'serv':35B 'share':79B 'singl':76B 'site':69B 'skylawsinstaller.dmg':34B 'unknown':74B 'url':83B 'vendor':85B 'victim':56B 'warn':21B 'went':70B 'write':87B 'write-up':86B 'yet':89B","search_c":"","first_public_at":"2026-11-07T12:43:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-bdenhj","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-07T12:51:18+00:00","fetched_at":"2026-11-07T12:51:18+00:00","note":null}],"documents":[{"id":95401,"url":"https://x.com/malwrhunterteam/status/2119048043223752796","title":"@malwrhunterteam: The \"SkyLawsInstaller.dmg\" sample coming from here is obviously totally legit, i","kind":"post","source":"x","publisher":null,"text":"The \"SkyLawsInstaller.dmg\" sample coming from here is obviously totally legit, impossible to be (some boring Mac) malware: https://apple.eu10hub[.]com/get_file?file=91A2T8Ehs06E\n😂\n🤷‍♂️ https://t.co/2oBVarK2AO\n\nlikes 4 reposts 1","published_at":"2026-11-07T12:43:18+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}