A newly observed variant of the SHub macOS infostealer, dubbed “Reaper,” is expanding its capabilities with stealthier delivery, enhanced data theft, and a persistence mechanism disguised as a legitimate Google software update.
The Reaper variant continues SHub’s use of fake application installers, notably masquerading as WeChat and Miro downloads.
However, its infection chain stands out by shifting disguises at each stage. Victims may initially land on typo-squatted domains such as Microsoft [.]co[.]com, before executing what appears to be an Apple security update.
Instead of relying on traditional “ClickFix” tactics that require manual Terminal input, Reaper leverages the applescript:// URL scheme.
Security researchers at SentinelOne said in a report shared with GBhackers, that this evolution reflects a broader trend in which macOS-targeted malware is adopting layered social engineering and fileless execution techniques to evade detection.
This technique automatically opens macOS Script Editor with a preloaded malicious script. The visible content is padded with benign text and ASCII art, hiding the actual payload below the fold.
When executed, the script displays a fake XProtect update message while silently running a Base64-decoded command to fetch and execute a remote shell script via curl and zsh.
Reaper includes built-in checks to avoid infecting systems in certain regions. It queries macOS input settings and exits if Russian language indicators are detected, sending a “cis_blocked” signal to its command-and-control (C2) server.
The lure websites also perform extensive fingerprinting before delivering the payload. These checks include:
Collected data is exfiltrated via a Telegram bot. The sites also deploy anti-analysis defenses such as blocking developer tools, overriding console functions, and triggering infinite debugger loops.
Once executed, the AppleScript prompts users for their macOS password under the guise of a system request. The credentials are harvested and used to access sensitive data, including Keychain entries and browser-stored secrets.
Reaper targets a wide range of applications:
A new addition is an AMOS-style Filegrabber module. It scans Desktop and Documents folders for valuable files such as .docx, .xlsx, .json, .wallet, and .rdp, staging up to 150MB of data.
If the archive exceeds size limits, it splits data into 70MB chunks for staged exfiltration via HTTP requests.
Beyond data theft, Reaper actively tampers with cryptocurrency wallets. It replaces core application files (e.g., app.asar) with trojanized versions downloaded from the C2 server.
The malware then bypasses macOS Gatekeeper protections using xattr -cr and ad hoc code signing, enabling continued interception of wallet activity.
A key enhancement in the Reaper variant is its persistence technique. The malware creates a directory mimicking Google’s update framework:
~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/
It drops a malicious script named GoogleUpdate and registers it using a LaunchAgent file com.google.keystone.agent.plist. This LaunchAgent executes every 60 seconds, acting as a beacon to the C2 server.
If the server responds with instructions, the malware executes them dynamically, enabling remote code execution and long-term access. This effectively turns the infected system into a persistent backdoor.
Reaper’s reliance on native macOS tools like AppleScript and Script Editor allows it to evade traditional file-based detection systems such as XProtect. Behavioral detection becomes critical.
Defenders should monitor for:
The Reaper variant highlights how macOS malware is evolving beyond simple infostealers into persistent, multi-functional threats.
By combining social engineering, fileless execution, and trusted brand impersonation, attackers significantly increase their chances of evading both users and security tools.
| hebsbsbzjsjshduxbs[.]xyz | Primary C2 |
| hxxps[://]hebsbsbzjsjshduxbs[.]xyz/api/debug/event | C2 Endpoint |
| hxxps[://]hebsbsbzjsjshduxbs[.]xyz/api/bot/heartbeat | C2 Endpoint |
| hxxps[://]hebsbsbzjsjshduxbs[.]xyz/gate | C2 Endpoint |
| qq-0732gwh22[.]com | Fake WeChat Lure Domain |
| mlcrosoft[.]co[.]com | Fake WeChat Lure Domain |
| mlroweb[.]com | Fake Miro Lure Domain |
| Filepath | Purpose |
| ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate | Backdoor Binary |
| ~/Library/LaunchAgents/com.google.keystone.agent.plist | Persistence mechanism |
| /tmp/shub_log.zip | Staged exfiltration archive |
| /tmp/shub_split.sh | Archive splitting utility |
| /tmp/shub_mzip_*.zip | Segmented archive chunks |
| /tmp/.c.sh | Ephemeral backdoor execution script |
| /tmp/*_asar.zip | Downloaded wallet payloads, e.g., exodus_asar.zip, ledger_asar.zip |
| Build ID | 6552824c59ddacb134073f24a4bd4724514a938a9dc59f1733503642faed3bd3 |
| Build Name | Reaper |
| Hardcoded Build Hash | c917fcf8314228862571f80c9e4a871e |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…