Repository navigation
Malicious site pearcleaner.com impersonating this project (confirmed malware, 12/92 on VirusTotal) #592
Description
Heads up: pearcleaner.com is not affiliated with this project and is
distributing macOS malware under the Pearcleaner name. It ranks well in
search results and mimics the README (Homebrew / git clone / DMG tabs), so
users are landing there instead of GitHub.
I got hit this morning (2026-07-30, 07:22 CEST). The installer never installs
Pearcleaner — it drops a payload and deletes itself.
[same technical detail as above]
12/92 engines on VirusTotal flag the domain. Reported to Google Safe Browsing.
Might be worth a warning in the README pointing to the only official sources
(GitHub Releases / brew install --cask pearcleaner), since the fake site
borrows your project's structure closely enough to be convincing.
Activity
Antoinenz commentedon Aug 3, 2026
looks like the site got taken down btw
Zacharyii commentedon Aug 7, 2026
Unfortunately, today I accidentally visited that website. I thought it was the official website, so I executed their command-line instructions. It asked me to enter my computer’s password and provided access to additional information. But I immediately realized it was a virus, so I refused and terminated the process. Later, I found that the virus had accessed a lot of information on my computer, including my passwords and databases from various applications.
buzzzzz192 commentedon Aug 23, 2026
hey guys, unfortunatley the same has happened to me just now but unfortunately i did give it the password adn it executed something. i dnt know what can be doen to fix it now. Any help please?
RobinWts commentedon Sep 2, 2026
Attention: This Problem persists, the site delivers Atomic macOS Stealer via a masked terminal install.
DO NOT USE!
manuelpoelzl commentedon Sep 15, 2026
I highly encourage anyone here to use cloudlare 1.1.1.2 and 1.0.0.2 as your DNS servers. This is what saved me.
Was visiting the site and immediately got hit with a ERR_CONNECTION_REFUSED, gave the url to virustotal and it confirmed there was malware on it.
Endromia-9027 commentedon Sep 28, 2026
lucky me I clicked the CTA at the bottom of the page which redirected me to the releases of the official repo, however the one on the navbar and the top were redirecting to other harmful sites.