Loading story…
Threat actors are impersonating the popular macOS utility CleanMyMac to distribute SHub Stealer, using the lookalike domain cleanmymacos[.]org to lure users into executing malware. The campaign uses the ClickFix technique, which socially engineers victims into opening Terminal and pasting a command that appears legitimate but ultimately downloads and runs a malicious script; because the user initiates execution, common macOS protections such as Gatekeeper, XProtect, and notarization checks may be bypassed.
Post-infection, SHub Stealer targets high-value data including saved credentials, cookies and autofill data from Safari and numerous Chromium-based browsers, Apple/iCloud artifacts (including Keychain-related data), Telegram session files, Apple Notes data, and a wide range of cryptocurrency wallet extensions. Reporting attributes additional capabilities to SHub beyond basic credential theft, including per-victim tracking, geofencing logic that exits when a Russian-language keyboard is detected (a common CIS-avoidance behavior), and persistence mechanisms such as replacing a crypto wallet app with a trojanized copy and installing a Google Update service–spoofing LaunchAgent to maintain long-term access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Malwarebytes' analysis revealed that SHub Stealer steals browser credentials, cookies, autofill data, Keychain and iCloud-related data, Telegram session files, Apple Notes data, and cryptocurrency wallet information. The report also described geofencing and CIS-avoidance checks, C2 communications, persistence via a fake Google Keystone LaunchAgent, and trojanization of wallet applications such as Exodus, Atomic Wallet, Ledger Live, and Trezor Suite.
Threat actors set up the spoofed domain cleanmymacos[.]org to impersonate the CleanMyMac utility site and deliver the SHub Stealer macOS malware to visitors. The campaign used a ClickFix-style social engineering lure to convince users to open Terminal and execute a malicious command themselves.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlighted **ClickFix**-style social engineering that convinces users to paste attacker-supplied commands into a terminal, leading to infostealer installation. Malwarebytes documented a macOS lure impersonating *CleanMyMac* via `cleanmymacos[.]org`, where victims are instructed to run a Terminal command that prints a reassuring message, decodes a hidden (base64) destination, and then downloads and executes a remote shell script via `zsh`. The resulting payload installs **SHub Stealer**, which targets saved passwords, browser data, Apple Keychain contents, Telegram sessions, and cryptocurrency wallets; it can also tamper with wallet applications (e.g., *Exodus*, *Atomic Wallet*, *Ledger Live*) to enable later theft of recovery phrases. Microsoft threat intelligence (as reported by The Hacker News) described a parallel **Windows** ClickFix campaign that shifts from the traditional Run-dialog paste to **Windows Terminal** (`wt.exe`) using the `Win + X → I` shortcut, exploiting the tool’s administrative legitimacy to reduce suspicion and evade detections tuned to Run-dialog abuse. In that chain, users paste a hex-encoded/XOR-compressed command that spawns additional Terminal/PowerShell stages to decode scripts, download a ZIP payload plus a legitimate-but-renamed **7-Zip** binary, extract additional components, establish persistence via **scheduled tasks**, configure **Microsoft Defender exclusions**, and ultimately deploy **Lumma Stealer** (including use of `QueueUserAPC()` for injection).
Jun 29, 2026
Researchers reported a macOS malware campaign distributing an updated **SHub Stealer** variant, dubbed **Reaper**, through fake download pages impersonating trusted software such as WeChat and Miro. The infection chain uses an automated ClickFix-style technique that avoids Terminal paste protections in macOS by opening the built-in **Script Editor** through an `applescript://` link with malicious code already loaded, requiring only a single user action to run. The malware then presents a fake Apple security update prompt to capture the victim’s password while using typo-squatted domains and brand impersonation to make the attack appear legitimate. Once executed, Reaper steals documents, browser credentials from Chrome, Firefox, Brave, Edge, and Opera, along with Keychain and iCloud-related data, Telegram sessions, and cryptocurrency wallet information. It exfiltrates files in chunked ZIP archives to attacker-controlled infrastructure, including via `curl`, modifies legitimate desktop crypto wallet applications to redirect future funds, and establishes persistence through a fake Google Software Update service. Researchers also said the malware checks for a Russian keyboard layout and exits if detected, and noted that this is the third observed automated ClickFix-style macOS campaign in less than two months, indicating the technique is gaining traction among macOS threat actors.
Jun 29, 2026
Researchers identified a **ClickFix-style** campaign targeting macOS users that swaps Terminal-based execution for **Script Editor** to bypass newer Apple protections. Victims are lured to fake Apple-themed pages such as “Reclaim disk space on your Mac,” which invoke the `applescript://` URL scheme and open Script Editor with a pre-filled AppleScript. If the user runs it, the script conceals a malicious shell command that decodes a URL, uses `curl` with TLS certificate validation disabled, and pipes the response directly into `zsh` for in-memory execution. The activity, discovered by **Jamf Threat Labs**, ultimately downloads and launches a Mach-O variant of **Atomic Stealer**, an infostealer built to harvest browser credentials, saved passwords, cryptocurrency wallets, and other sensitive data from macOS systems. Researchers said the campaign appears to be an adaptation to Apple’s paste-command scanning protections added in macOS 26.4 for Terminal abuse; while newer macOS versions also warn about unidentified scripts, the attack can still succeed if users follow the prompts. Reported infrastructure tied to the campaign includes `dryvecar.com`, `storage-fixes.squarespace.com`, and `cleanupmac.mssg.me`.
Jun 29, 2026