SHub Stealer

Hosting Layer: The secondary payload packages are hosted on typo-squatted web domains mimicking legitimate Microsoft infrastructure.

the infection vector wraps its payload inside a seemingly normal, signed application installer disguised as standard collaboration tools like Miro or WeChat.

Victims are directed to high-fidelity, deceptive web interfaces that simulate legitimate services.

Reaper uses fake WeChat and Miro installers as lures... Instead of forcing text interaction, the infection vector wraps its payload inside a seemingly normal, signed application installer disguised as standard collaboration tools like Miro or WeChat.

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist).

Initial commands leverage curl to fetch obfuscated payloads, which are piped directly into shell interpreters (bash/zsh), minimizing the disk footprint.

ClickFix variant that uses the applescript:// URL scheme to invoke the macOS Script Editor... This URL-encoded hyperlink runs a dual-track routine... while silently executing the curl command in the background to deliver an infostealer, bypassing Gatekeeper via user-coerced interaction.

Since February 2026, one observed campaign variant uses curl to pull a loader shell from attacker infrastructure the moment the ClickFix command runs. That loader is a zsh script, a macOS default shell that decodes and decompresses an embedded payload using Base64 and Gzip before executing it in memory using eval.

The page provides detailed instructions to the victim to open the Terminal and paste the command to complete the installation.

Attackers exploit this trust by providing malicious command strings that mimic legitimate installation procedures.

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist).

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist). This service runs every 60 seconds.

Long-term access is secured via LaunchAgents and .plist files, often masquerading as legitimate system or software updaters.

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist).

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist). This service runs every 60 seconds.

Long-term access is secured via LaunchAgents and .plist files, often masquerading as legitimate system or software updaters.

line 13 displays an obfuscated curl command that uses the native tr utility to dynamically decode a hidden URL

Long-term access is secured via LaunchAgents and .plist files, often masquerading as legitimate system or software updaters.

It then checks whether the infected system uses a Russian keyboard layout (a common CIS geofencing technique). If a Russian keyboard is detected, the script sends a "cis_blocked" telemetry event to the command-and-control server and terminates immediately.

piping the payload directly into zsh for memory-resident execution to avoid disk detection.

The malware attempts to steal the macOS login password. It displays a fake “System Preferences” dialog (with the official LockedIcon) up to 10 times, asking the user to enter their password.

Exfiltration efforts focus on high-value data, including ... messaging session tokens (Telegram/Discord)

Once active on the host machine, Reaper runs a local configuration sweep that targets typical info-stealer objectives—vacuuming system profiles, local browser credential vaults, session cookies, and cryptocurrency wallet keys.

Exfiltration efforts focus on high-value data, including browser credentials (Chromium/Firefox), macOS Keychains

Exfiltration efforts focus on high-value data, including ... macOS Keychains

Exfiltration efforts focus on high-value data, including browser credentials (Chromium/Firefox)

Subsequent stages often involve a native-looking password prompt to facilitate credential harvesting under the guise of installation continuity.

The first thing the loader does is system fingerprinting by collecting the hostname, macOS version, external IP address, and keyboard layout information.

Sensitive assets are staged in temporary directories (e.g., /tmp/shub_), compressed, and exfiltrated via encrypted HTTPS channels.

It then checks whether the infected system uses a Russian keyboard layout (a common CIS geofencing technique). If a Russian keyboard is detected, the script sends a "cis_blocked" telemetry event to the command-and-control server and terminates immediately.

Once active on the host machine, Reaper runs a local configuration sweep that targets typical info-stealer objectives—vacuuming system profiles, local browser credential vaults, session cookies, and cryptocurrency wallet keys. The module is engineered to search local user paths for high-value text documents, PDFs, spreadsheet configurations, and database assets.

The malware attempts to steal the macOS login password. It displays a fake “System Preferences” dialog (with the official LockedIcon) up to 10 times, asking the user to enter their password.

Clicking on fake streaming links can result in full device compromise, including silent theft of passwords, banking credentials, browser sessions, and crypto wallets with a persistent backdoor left running in the background.

Sensitive assets are staged in temporary directories (e.g., /tmp/shub_), compressed, and exfiltrated via encrypted HTTPS channels.

The native LaunchAgent configuration is designed to trigger this GoogleUpdate beacon script automatically every 60 seconds, logging system details and checking in with the C2 server’s /api/bot/heartbeat endpoint.

Initial commands leverage curl to fetch obfuscated payloads

Sensitive assets are staged in temporary directories (e.g., /tmp/shub_), compressed, and exfiltrated via encrypted HTTPS channels.

By presenting deceptive "fixes," "verifications," or installation prompts, adversaries induce users to manually execute malicious scripts via native utilities such as the Terminal or Script Editor.