I think the worst thing about this is that the malware author *could* have made their installer script so much better, they basically have you do "install malware && install brew", why not have the malware installer pass off to a homebrew installer once it's finished? Why not serve the malware from the fake domain, instead of a random third domain?
Scammers really don't have care for their craft.
https://agora.echelon.pl/objects/310d887d-e111-48a4-9331-bc9e6b8cdd3b
Will Richardson /
npub137…rf0xv
2025-01-20 01:35:46
Author Public Key
npub137ddq8nm77tmwhc6gkhugwfvn7f74fdrmn6tgd3nel777z5mr7qqsrf0xvPublished at
2025-01-20 01:35:46Event JSON
{
"id": "1997a2c7cfe2c4b61c7b6cad5337feb7a3c396e63800c817d1289c2b6aad3372",
"pubkey": "8f9ad01e7bf797b75f1a45afc4392c9f93eaa5a3dcf4b43633cffdef0a9b1f80",
"created_at": 1737336946,
"kind": 1,
"tags": [
[
"proxy",
"https://ruby.social/users/willhbr/statuses/113858114121201093",
"activitypub"
]
],
"content": "I think the worst thing about this is that the malware author *could* have made their installer script so much better, they basically have you do \"install malware \u0026\u0026 install brew\", why not have the malware installer pass off to a homebrew installer once it's finished? Why not serve the malware from the fake domain, instead of a random third domain?\n\nScammers really don't have care for their craft.\nhttps://agora.echelon.pl/objects/310d887d-e111-48a4-9331-bc9e6b8cdd3b",
"sig": "065a1eee0b35a1b6c2e59191fc0bf1b5e7d4757cd60fdcce381e46ec1cd525d5304c6bb9b3d338e0170e85651fc490fcbf8fa95fd3a68b09c1acd80ede3397eb"
}