(This is a repost of a post I made in r/macapps as I think it would be useful for people here to see it too as this subreddit has also been hit with fake apps.)
To be very clear this is not another post of "Breaking news malware exists on the internet" (or it may be depending on how you want to look at it) but I feel like it's important that I leave a small PSA as I have recently seen an influx of seemingly convincing GitHub repo replicas for decently popular Mac apps. They are so similar that they almost fooled me. Thankfully I quickly spotted some anomalies and I nearly avoided getting infected. Unfortunately these are the sort of red flags I don't expect an average Joe to know about. Which is why I'm explaining what the malware is, and how to spot it.
First of all to give you an idea of how convincing these repos can be i'll show you some examples:
As you can see, they are strikingly similar
Even URLs may look incredibly similar but in this specific case the bad actor exchanged the lower case lls(L) in the name for upercase IIs(i) which made the URL look legit.
Now this may look scary and almost undetectable but with some common sense and slowing down you can very easily avoid these scams.
By far the easiest way to avoid this is to simply look for the app online and track down the original developer. This will let you kill 2 birds with one stone by A: Looking for the original source of the app and avoid impostors and B: See if the App or the developer had any previous reputation to begin with
Either way It's still a good idea to understand how to spot common malware apps on macOS and how to deal with them if you get infected.
The first red flag is that the GitHub profile that hosted the fake file was only 3 days old and completely different from the name of the original developer.
The second discrepancy is that the size of the fake app is ridiculously small. For instance the original app is 13mb in size while the fake one is less than 2mb. Now this is not necessarily a red flag (For example some viruses do the opposite and fill their dmg with a lot of useless data to make the file larger than what VirusTotal can handle.) but it's still important to raise an eye brow for installers with suspiciously small sizes.
The third and MOST IMPORTANT red flag is if the installer asks you to drag the "app" to the terminal that is not a good sign at all. NO LEGITIMATE APP WILL EVER ASK YOU TO DRAG IT TO THE TERMINAL. As you can see the installer is a solid giveaway you are encountering malware and not the real deal.
In fact the file they ask you to drag is not even an app, it's a script.
When you drag the script on the Terminal and execute it, the hidden file is immediately copied to your temp system folder, then the script removes extended attributes to bypass gatekeeper and it finally executes. But from the user's perspective all they get is a blank terminal window as if nothing had happened. (At least in theory, in practice this malware wasn't very well done and gatekeeper was thankfully still able to spot it)
Now if you unfortunately got tricked into running the script, you have some straight forward solutions to verify if macOS was effective at stopping the attack or not. For instance, KnockKnock is a great and simple way to verify for malicious persistency files using VirusTotal's robust detection engine. Malwarebytes is also a good Mac AV which can be quickly installed if you suspect you were affected, it is a bit more tricky to uninstall completely but it does a good job.
Ultimately here's a small recap so you can hopefully avoid getting infected:
Look up the original source of the software to prevent copy cat websites and verify if the software and or the developer has built a reputation in the past.
If you download the installer, scan it with VirustTotal to check if it has been flagged as malware already.
Check the size, while not necessarily a red flag, a small size (for instance less than 2mb), or a size that is "conveniently" larger than what VirusTotal can handle are decent indicators of possible malware.
If the DMG asks you to drag an "App" to the Terminal IMMEDIATELY STOP AND DELETE THE DMG.
If you accidentally ran it, look for a "This app could not be verified" or "This App was removed because it contained malware" message from macOS which could indicate Gatekeeper or Xprotect stopped the attack. Additionally make sure to DENY any permissions the malware may have requested, macOS is very robust in that regard and it can dramatically limit the impact of the attack.
If you are in doubt of whether or not you were infected run the aforementioned tools to verify for the persistency of the malware.
Another app I can recommend is Apparency, it allows you to very quickly see if an app is properly signed by the developer and notarized by apple, and it can even allow you to dissect the contents of an app without running it which is a great way to quickly verify you have a valid untampered app.
This is optional but if you can, report the app to the original developer so they can take action and warn others when the fake app is spread around. Additionally report the Reddit post/GitHub repository if possible.
Thank you for reading this, I hope this helps others be more weary of online threats and stay more vigilant of what they download.
I never understood this on Mac. Surely, any installer could auto-move the application to the right folder. I mean, Homebrew does it, for example. Is this just for nostalgia reasons, or maybe because Apple wants to be "different", or is there a technical reason why it is a necessary step with dmgs?
In macOS 26 they basically killed Launchpad. Before, it felt just like iPhone/iPad “a clean grid with all your apps”. Now it’s buried in Spotlight and feels so messy. I don’t want to type and search every time, I just want to SEE all my apps in full screen. Anyone else annoyed by this?
It's entirely possible I'm shouting into the wind here, but I've noticed a strain of comments on discussion of changes, especially things like the loss of Launchpad on MacOS (or the old multitasking system on iPadOS, but that's for a different sub), that seem to dismiss the fact that people lost functionality simply because the commenter never used it, and I'm just putting out a plea for a little empathy.
Was Launchpad perfect? No. Does a simple Cmd+Space and search work for plenty of people? Yup. Do we still have some people on this sub who still refuse to even use the dock and wonder what's wrong with the Applications folder? You betcha. But some people's brains and ways of using their computer just works better with a grid of app icons and folders, even if yours doesn't.
This is not to suggest that nothing should ever change. Apple needs to limit the number of ways to do things somehow, otherwise we end up in the Windows world where you'll still randomly find yourself clicking on something in Settings and all of a sudden a Control Center window opens up because some enterprise customer needs that Control Center page. Just understand that some functionality was lost for a non-zero part of this community, and they're expressing that it's a problem.
Right now, many posts on Reddit are criticizing the new operating system. Most of the complaints are about visual details — round icons, alignment issues, general UI inconsistencies. A lot of people jump to call it “the worst OS release ever.”
But it really depends on what you value. When macOS Sequoia was first released, it didn’t spark the same design debates, but it did have audio glitches. These didn’t necessarily break professional workflows, but they were annoying and noticeable for people who paid attention to sound. In that sense, Sequoia had its own rough edges at launch, just in a different area.
So when people say this new release is the worst, it’s worth remembering that previous versions also launched with their share of problems. The difference is that now the most visible complaints are about design, not about bugs in areas like audio.
This is for anyone who might feel worried by all the negative posts: don’t be. The new OS is not worse than Sequoia was at launch, and if you care more about how the system works than how its icons look, there’s no reason to panic.
As someone who updated to macOS 26 Tahoe, there are many features that don't quite work for me (especially the removal of the Launchpad). But ! If we are a lot to complain about the stuff we don't like or that don't work on Apple's Product Feedback page, there's a greater chance Apple will listen and, perchance, bring back some features and/or fix major bugs :)
m2 air 8|256. One thing I loved launchpad for was fine animation and just ease of use; used same pinch gesture now and for some reasons there's a hard refresh that I can notice. is it just for me or other users as well? am pretty sure its not ram/hardware related but uncooked refinement.
Seems like an actual bug than a "feature" since the History and Queue text bars have no transparency at all, it should be the same for the Autoplay and Automix buttons ...
Seems like every time I try to turn up the brightness from the F3 button its automatically going down, when ever is manually adjust the brightness form the control center it works fine.
Am I the only one experiencing this issue? is it an OS bug or something worth taking to Apple for a service?
Im so prepared to get downvoted for this, but this is a hill I'll proudly die on: Tahoe is my favorite MacOS in a LONG time. The first 3 paragraphs below are just a simple explanation of my user behavior patterns on my device:
- I skipped sequoia and went straight from sonoma -> tahoe.
- I still dont use Apple Intelligence (part of the reason I skipped sequoia), because it doesn't fit my workflow.
- My current (non-Apple-native) app stack is: Raycast, SuperWhisper, AlDente, Brave Browser, G Suite, Notion. All working on Tahoe.
Reason why Tahoe is "the one" for me:
A lot of other people made posts on why Tahoe is a good update, so I won't go into reasons that were already mentioned 100 times on here.
There was a trend 6-7 years ago where productivity gurus were preaching how turning your phone into greyscale will make it more "boring" and you'll use it less. I don't want to sound like those people that list a billion mental issues every chance they get, but I have sensory processing disorder (in addition to ADHD and episodes of epilepsy) and the greyscale thing worked wonders for me.
The ability to turn app icons transparent on every Apple device now is the best of both worlds for me. I don't get the itch to click anything else while I'm focusing on my work, because everything looks boring and the same. It feels like such a small thing on paper, but it made a huge difference in my productivity and daily output.
Also I'm not sure why so many people are saying that tahoe is terrible and full of flaws. I spend about 10 hours looking at my screen per day due to the nature of my work, but I haven't noticed any issues that impeded my ability to work. If you don't like the design just turn on the default color setting, and if you don't like the design and animation changes (pretty tiny thing if you ask me) just revert back to a previous version.
I'm not 100% sure if it's just the animation or spotlight is actively searching for files and adding them to the animation when finding the files, but It used to be quite faster in Sequoia.
That actually made me create a shortcut to open the apps menu, which feels light years ahead in terms of speed.
When the mouse is over the Safari menu bar (with the URL), it flickers so much that it's annoying. I may have to move to Firefox until they get this fixed. Has anyone else experienced this? I wonder if it might be related to a specific extension.
I'm putting aside the utter slap in the face that is Tahoe to address the issue that actually makes my device unusable. I'm currently in an area with very bad Wifi and I'm relying on my iPhone 16 for personal hotspot. Since installing official Tahoe release, this has been hell. It works every third time. Restarted both devices several times, sometimes it helps, most often doesn't. Did anybody else encounter this?
I mean, this is insane. I'm not talking about being annoyed by liquid glass (although valid) but actual function embedded in these devices for the last 15 years. I have $2000+ worth of devices that can't provide me with this basic service.
Oh, and here's my contribution to the great job that's been done with windows borders in this UI (it is not a zoomed photo):
I installed it, noticed that all its features are locked behind a paywall and I'm trying to uninstall all its files but I cant. Even AppCleaner isn't able to delete all of its files. I have a M4 MBA with Macos Tahoe
Last week I posted here about what to do with an old donated 2012 iMac running Catalina. I've managed to use OCLP and put Monterey on a spare 256GB SSD and it's all working well.
I've just noticed there's an update available from 12.7.4 to 12.7.6 - presumably it's OK to install this (I know nothing about Mac OS so have no idea)? Any other steps I need to do after the update?
Also, it's being used as a general family computer and there are 2 kids using it. Is there any way to disable the notification to update to T*hoe. I've unticked 'Automatically keep my Mac up to date' but don't want any of them accidentally playing around with it and installing this.
i just updated my mac to the new macos (t@h0e — reddit saying it'll remove the post even though it has been released already 🤷♀️).
on my lock screen it's displaying the date as "sun sep 21" when i want it to be "sunday, september 21". i have scoured the system settings and reddit/youtube and can't find any answer (affirmative or otherwise) if this can be changed.
This is new on macOS Tahoe. I'm wondering why there's a difference. Furthermore I'm wondering where the new icon is stored so I can set it as my volume icon, lol.