Reaper

The attack starts on fake software pages hosted on misspelled Microsoft web domains, such as mlcrosoft.co.com.

the infection vector wraps its payload inside a seemingly normal, signed application installer disguised as standard collaboration tools like Miro or WeChat.

The updated build, now called Reaper, spreads through fake websites that impersonate popular software... It uses a fake webpage to silently open your Mac’s Script Editor, pre-loaded with malicious code, and all a user has to do is click one button to unknowingly launch the infection.

Reaper uses fake WeChat and Miro installers as lures... Instead of forcing text interaction, the infection vector wraps its payload inside a seemingly normal, signed application installer disguised as standard collaboration tools like Miro or WeChat.

Attackers spoof well-known brands and host malware payloads on domains that look nearly identical to legitimate ones. They pass off malware downloads as Apple security updates...

Before finishing its initial run, Reaper establishes persistence using a directory structure built to mimic Google’s legitimate Keystone update service. It places a base64-decoded bash script named GoogleUpdate... then registers a LaunchAgent using a property list named com.google.keystone.agent.plist . This causes the script to execute silently every 60 seconds in the background.

Reaper drops a highly persistent User LaunchAgent script onto the host... The native LaunchAgent configuration is designed to trigger this GoogleUpdate beacon script automatically every 60 seconds, logging system details and checking in with the C2 server’s /api/bot/heartbeat endpoint.

the fake websites use a specific internet link format ( applescript:// ) to automatically open the built-in macOS Script Editor app. The hackers hide the malicious code inside the app by using extensive ASCII art and arbitrary whitespace injection to obfuscate the functional script sequences below the visible scroll boundary

File Name GoogleUpdate Encoded Base64 bash script planted as part of the persistence backdoor

the fake websites use a specific internet link format ( applescript:// ) to automatically open the built-in macOS Script Editor app... When a user clicks the play button, thinking they are running a normal system update, the script executes.

Before finishing its initial run, Reaper establishes persistence using a directory structure built to mimic Google’s legitimate Keystone update service. It places a base64-decoded bash script named GoogleUpdate... then registers a LaunchAgent using a property list named com.google.keystone.agent.plist . This causes the script to execute silently every 60 seconds in the background.

LaunchAgent com.google.keystone.agent.plist LaunchAgent property list used to register and persist the backdoor

Finally, it sets up a permanent backdoor inside a fake Google Software Update directory to maintain remote access to the computer.

Before finishing its initial run, Reaper establishes persistence using a directory structure built to mimic Google’s legitimate Keystone update service. It places a base64-decoded bash script named GoogleUpdate... then registers a LaunchAgent using a property list named com.google.keystone.agent.plist . This causes the script to execute silently every 60 seconds in the background.

LaunchAgent com.google.keystone.agent.plist LaunchAgent property list used to register and persist the backdoor

Finally, it sets up a permanent backdoor inside a fake Google Software Update directory to maintain remote access to the computer.

The hackers hide the malicious code inside the app by using extensive ASCII art and arbitrary whitespace injection to obfuscate the functional script sequences below the visible scroll boundary of the graphical user interface.

the campaign distributing an updated version of SHub Stealer under the build tag Reaper... attackers used fake download pages for popular apps such as WeChat and Miro to target victims.

If the server returns a “code” payload, the script decodes it, writes it to /tmp/.c.sh , runs it with the current user’s privileges, and then deletes it.

Reaper then checks the computer’s keyboard configuration. If the keyboard is set to the Russian language, the program completely shuts down.

Otherwise, it retrieves a second AppleScript containing the core extraction logic and runs it in memory via osascript, never directly touching the local disk.

Once the script runs, it displays a fake Apple security update message to trick the user into typing in their system password.

Earlier builds could already steal browser data, macOS Keychains, iCloud account data, and Telegram session information. The new version goes much further, now targeting Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion browsers, along with their extensions.

Earlier builds could already steal browser data, macOS Keychains, iCloud account data, and Telegram session information.

Reaper includes a FileGrabber routine that scans the Desktop and Documents folders for files likely to hold business or financial value.

Reaper then checks the computer’s keyboard configuration. If the keyboard is set to the Russian language, the program completely shuts down.

The malware also carries an AMOS-style Filegrabber that hunts through Desktop and Documents folders for valuable files, including .docx, .wallet, .key, .csv, .xls, and .json formats.

Once the script runs, it displays a fake Apple security update message to trick the user into typing in their system password.

Files are staged in /tmp/shub_random/ before being split into 10MB chunks and uploaded to the attacker’s server via curl.

The malware also targets internet browsers like Chrome, Firefox, and Edge to steal saved passwords, along with browser extensions like 1Password and MetaMask.

specifically storing .docx, .pdf, .xlsx, .wallet , and .keys files into compressed 70MB chunked ZIP archives.

These archives are transmitted via standard curl commands to an external command-and-control server at hebsbsbzjsjshduxbs.xyz/gate/chunk.

Every time the LaunchAgent fires, the script sends system details to the attacker’s /api/bot/heartbeat endpoint. If the server returns a “code” payload, the script decodes it... Reaper includes a FileGrabber routine... uploaded to the attacker’s server via curl.

These archives are transmitted via standard curl commands to an external command-and-control server at hebsbsbzjsjshduxbs.xyz/gate/chunk .