SHub macOS infostealer variant spoofs Apple security updates

# SHub's Reaper Variant Bypasses macOS Protections with Fake Apple Updates and AppleScript

## The Threat

A sophisticated new variant of the SHub macOS infostealer—dubbed Reaper—has emerged as a significant threat to macOS users, deploying tactics that circumvent Apple's recent security hardening efforts. The malware uses AppleScript combined with spoofed Apple security notifications to trick users into authorizing installation of a backdoor and data-stealing payload, according to research published by SentinelOne on May 18, 2026.

The attack chain begins with users being lured to malicious domains impersonating legitimate software vendors. These fake sites mimic WeChat, Miro, and other popular applications, using typosquatted domain names designed to fool less experienced users (e.g., qq-0732gwh22[.]com, mlcrosoft[.]co[.]com, mlroweb[.]com). Once users visit these sites, their devices are fingerprinted to check for virtual machines, VPNs, and installed security tools—allowing attackers to avoid honeypots and analysis environments. The malware also enumerates browser extensions to identify password managers and cryptocurrency wallet tools before proceeding.

This represents a notable evolution in macOS infostealer tactics. Earlier SHub campaigns relied on "ClickFix" techniques, wherein attackers tricked users into copying and pasting commands into the Terminal application. Apple's March 2026 macOS Tahoe 26.4 release blocked this vector by preventing Terminal from executing certain pasted commands. Rather than abandon the malware platform, attackers pivoted to the applescript:// URL scheme, which launches macOS's Script Editor with pre-populated malicious code—bypassing Terminal protections entirely and exploiting legitimate system components as attack vectors.

## Severity and Impact

| Attribute | Details |

|-----------|---------|

| Threat Type | macOS Infostealer with Backdoor / Credential Stealer |

| CVE | Not assigned (0-day variant) |

| CVSS Score | Not publicly scored |

| Attack Vector | Network (malicious website) |

| Attack Complexity | Low |

| Privileges Required | None (initial) → User interaction for payload execution |

| User Interaction | Required (user must click fake installer and approve AppleScript) |

| CWE | CWE-494 (Download of Code Without Integrity Check), CWE-347 (Improper Verification of Cryptographic Signature) |

The Reaper variant targets a broad range of sensitive data. Once installed, it steals browser credentials from Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion. It extracts cryptocurrency wallets (MetaMask, Phantom), password managers (1Password, Bitwarden, LastPass), and desktop crypto applications (Exodus, Atomic Wallet, Ledger Live, Electrum, Trezor Suite). The malware also captures iCloud account data, Telegram session tokens, and developer configuration files. A "Filegrabber" module searches user Desktop and Documents folders for documents likely containing financial or sensitive information, collecting files up to 2–6MB with a 150MB aggregate limit.

A particularly dangerous capability is the malware's ability to hijack cryptocurrency wallet applications by terminating them, replacing their core files with malicious versions, and using code signing tricks to evade Gatekeeper protections.

## Affected Products

Targeted Software (via fake installers):

Targeted Browsers (credential theft):

Targeted Cryptocurrency Wallets (browser extensions):

Targeted Password Managers (browser extensions and desktop):

Targeted Cryptocurrency Wallets (desktop applications):

Affected Systems:

## Mitigations

For Individual Users:

For Organizations:

## References

---

## HackWire Analysis

The Reaper variant demonstrates a critical lesson in adversarial adaptation: when defenders close one door, sophisticated attackers don't retreat—they find another. Apple's March 2026 hardening of Terminal command pasting was a reasonable mitigation against ClickFix tactics, but it assumed attackers would remain dependent on that single attack vector. Instead, SHub operators simply retargeted the applescript:// URL scheme, which is a first-class macOS capability with fewer built-in protections.

This pivot reveals a deeper architectural challenge: macOS lacks parity in restricting potentially dangerous system-level automation across its various entry points. Terminal has new guardrails, but Script Editor remains accessible via URL handlers with minimal friction. The fact that AppleScript can seamlessly request Keychain access—and users grant it based on a prompt referencing a fake security update—exposes the vulnerability of trust-based security models when users are properly social-engineered.

The inclusion of Russian keyboard detection and geolocation evasion is noteworthy and suggests a sophisticated, professionally-run operation avoiding their own jurisdiction while targeting Western users with significant digital assets. Cryptocurrency wallets are the obvious prize here, but the breadth of data collection (browser credentials, iCloud tokens, developer files) indicates either opportunistic exfiltration for later sale or preparation for lateral movement into enterprise networks. Organizations with crypto treasury operations should consider this a direct threat.

The use of Telegram's Bot API for command-and-control is operationally efficient for attackers—Telegram's privacy-by-default architecture and lack of visibility into bot communications makes detection harder than traditional HTTP C2. For defenders, this means EDR tools must focus on detecting the *behavior* (unsigned binary modification, wallet process termination, bulk file collection) rather than relying on network signatures.

Organizations should audit their macOS fleet immediately for unsigned or recently-modified application bundles in ~/Applications and /Applications, particularly cryptocurrency and password management tools. — *HackWire Editorial*

---

## Related Coverage