Loading story…
SentinelOne researchers identified Reaper, a new macOS variant of the SHub infostealer, in campaigns that impersonate Apple security updates and legitimate software such as WeChat and Miro. The malware is delivered through typo-squatted and deceptive domains that use hidden JavaScript and the applescript:// URL scheme to open Script Editor and run concealed commands, presenting victims with a fake XProtectRemediator update prompt. The operation fingerprints visitors, exfiltrates telemetry through Telegram, and appears designed to avoid infecting systems using Russian keyboard input.
Once launched, Reaper downloads additional payloads, prompts users for their macOS password, and steals browser data, password manager contents, cryptocurrency wallet information, iCloud and Telegram data, documents, and selected files. Researchers said it can also hijack wallet applications by replacing core files with malicious payloads, then establish persistence through a LaunchAgent disguised as Google Software Update while polling command-and-control infrastructure every 60 seconds. SentinelOne warned that the malware provides attackers with backdoor access beyond basic infostealing and can bypass protections introduced in macOS Tahoe 26.4.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Technical details published by researchers showed Reaper abusing the applescript:// URL scheme and fake XProtectRemediator prompts to trick users into running malicious code and entering their macOS password. The malware was also found to establish persistence via a LaunchAgent masquerading as Google Software Update, exfiltrate stolen data, and avoid infecting systems that appear to use Russian keyboard input.
SentinelOne researchers identified a new macOS variant of the SHub infostealer, dubbed Reaper. The malware impersonates Apple security updates and popular software installers, uses typo-squatted infrastructure, and includes backdoor capabilities beyond basic data theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcehelpnetsecurity.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a macOS malware campaign distributing an updated **SHub Stealer** variant, dubbed **Reaper**, through fake download pages impersonating trusted software such as WeChat and Miro. The infection chain uses an automated ClickFix-style technique that avoids Terminal paste protections in macOS by opening the built-in **Script Editor** through an `applescript://` link with malicious code already loaded, requiring only a single user action to run. The malware then presents a fake Apple security update prompt to capture the victim’s password while using typo-squatted domains and brand impersonation to make the attack appear legitimate. Once executed, Reaper steals documents, browser credentials from Chrome, Firefox, Brave, Edge, and Opera, along with Keychain and iCloud-related data, Telegram sessions, and cryptocurrency wallet information. It exfiltrates files in chunked ZIP archives to attacker-controlled infrastructure, including via `curl`, modifies legitimate desktop crypto wallet applications to redirect future funds, and establishes persistence through a fake Google Software Update service. Researchers also said the malware checks for a Russian keyboard layout and exits if detected, and noted that this is the third observed automated ClickFix-style macOS campaign in less than two months, indicating the technique is gaining traction among macOS threat actors.
Jun 29, 2026
Threat actors are impersonating the popular macOS utility *CleanMyMac* to distribute **SHub Stealer**, using the lookalike domain `cleanmymacos[.]org` to lure users into executing malware. The campaign uses the **ClickFix** technique, which socially engineers victims into opening Terminal and pasting a command that appears legitimate but ultimately downloads and runs a malicious script; because the user initiates execution, common macOS protections such as *Gatekeeper*, *XProtect*, and notarization checks may be bypassed. Post-infection, **SHub Stealer** targets high-value data including saved credentials, cookies and autofill data from Safari and numerous Chromium-based browsers, **Apple/iCloud artifacts** (including Keychain-related data), **Telegram session files**, Apple Notes data, and a wide range of **cryptocurrency wallet extensions**. Reporting attributes additional capabilities to SHub beyond basic credential theft, including per-victim tracking, geofencing logic that exits when a Russian-language keyboard is detected (a common CIS-avoidance behavior), and persistence mechanisms such as replacing a crypto wallet app with a trojanized copy and installing a Google Update service–spoofing `LaunchAgent` to maintain long-term access.
Jun 29, 2026
Microsoft reported that **information-stealing malware activity is expanding from Windows to macOS**, driven by campaigns observed since late 2025 that rely on social engineering and cross-platform tooling. The activity includes **ClickFix-style prompts** and **malicious DMG installers** that deliver macOS-focused infostealer families such as **Atomic macOS Stealer (AMOS)**, **MacSync**, and **DigitStealer**, with operators leveraging **fileless execution**, **native macOS utilities**, and **AppleScript automation** to evade defenses and automate collection. Initial access commonly starts with **malicious search ads (e.g., Google Ads)** that redirect users to fake sites impersonating legitimate tools and then trick victims into running “fix” steps or installing trojanized software. The malware is assessed to target high-value data including browser credentials and session cookies, **iCloud Keychain** contents, crypto wallet data, and **developer secrets**; Microsoft also highlighted growing use of **Python-based stealers** distributed via phishing for rapid adaptation across heterogeneous environments, citing **PXA Stealer** (linked to Vietnamese-speaking actors) as an example used in late-2025 campaigns with persistence mechanisms such as registry `Run` keys or scheduled tasks and **Telegram** used for command-and-control.
Jun 29, 2026