SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 Terminal Mitigation via applescript:// URL Scheme, Spoofs Apple/Google/Microsoft (SentinelOne)
SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 (TL-2026-0526), also tracked as SHub Reaper, is a high-severity malware campaign, first published 2026-05-18 and last reviewed 2026-07-18. It has no confirmed attribution, affects Apple macOS, maps to 32 MITRE ATT&CK techniques (T1005, T1030, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0526
- Threat ID
- TL-2026-0526
- Also known as
- SHub Reaper, Reaper (SHub build tag)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-18
- Last reviewed
- 2026-07-18
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, cryptocurrency, developers, small-business, consumer
- Target regions
- North America, Europe, Asia, Global (CIS excluded)
- Detection rules
- 9
- Indicators of compromise
- 30
- Updates
- 2026-07-18 · revalidated 1× · latest source
Malware and tooling in SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4
Malware and tooling: SHub Reaper, SHub Stealer
SentinelOne disclosed a new SHub Stealer variant tagged 'Reaper' that abandons the ClickFix/Terminal social engineering used by earlier SHub builds in favor of the applescript:// URL scheme, launching macOS Script Editor pre-populated with a base64-decoded curl|zsh stub to bypass Apple's macOS Tahoe 26.4 Terminal mitigation. The infection layers trusted brands across each stage: payload hosted on a typo-squatted Microsoft domain (mlcrosoft[.]co[.]com), executed under a fake Apple XProtectRemediator update banner, and persisted from a counterfeit Google Software Update LaunchAgent. Reaper adds an AMOS-style Filegrabber with chunked uploads and a persistent backdoor on top of SHub's existing credential/wallet theft, and aborts on CIS hosts via com.apple.HIToolbox.plist input-source checks.
How SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 works
SHub Reaper is a new build of the SHub macOS infostealer family that SentinelOne (Phil Stokes) disclosed on 2026-05-18. The build tag 'Reaper' is embedded in the AppleScript payload alongside the static build hash c917fcf8314228862571f80c9e4a871e and the SHA256 6552824c59ddacb134073f24a4bd4724514a938a9dc59f1733503642faed3bd3. The variant retains the broad credential-stealing capability of earlier SHub builds (browser data from Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion; desktop wallets including Exodus, Atomic, Ledger Live, Electrum, and Trezor Suite; the macOS Keychain and iCloud account data; Telegram session data) but introduces three notable changes that warrant independent tracking from the previously documented SHub Stealer campaign (TL-2026-0471): a Terminal-bypass delivery technique, an AMOS-style document Filegrabber with chunked exfiltration, and a LaunchAgent-based backdoor.
Delivery begins with fake WeChat and Miro installer pages hosted on typo-squatted domains, notably mlcrosoft[.]co[.]com (Microsoft impersonation) along with qq-0732gwh22[.]com (fake WeChat lure) and mlroweb[.]com (fake Miro lure). These pages are not static; embedded JavaScript profiles the visitor's IP address, geolocation, WebGL fingerprint, and indicators of virtual machines or VPNs, enumerates installed browser extensions specifically looking for 1Password, Bitwarden, LastPass, MetaMask, and Phantom, and exfiltrates the collected telemetry to a hardcoded Telegram bot. The pages also implement aggressive anti-analysis: overriding console functions, intercepting F12 and other developer keystrokes, running a continuous debugger loop, and listening for the devtoolschange event to overwrite the page with a Russian-language 'Access Denied' message (<h1>Доступ запрещен</h1>) if DevTools is opened.
The core delivery innovation is the abuse of the applescript:// URL scheme to launch macOS Script Editor (Script Editor.app) pre-populated with the malicious payload, sidestepping Apple's Tahoe 26.4 mitigation that targeted ClickFix attack flows pasting commands into Terminal. The HTML page constructs the payload dynamically, padding it with ASCII art and fake terms so the malicious 'do shell script' line is pushed below the visible portion of the Script Editor window. When the victim clicks 'Run', AppleScript prints a fake update banner referencing Apple's XProtectRemediator update (e.g., https://support.apple.com/downloads/xprotect-remediator-150.dmg) while silently base64-decoding a hidden URL and piping the curl output into zsh.
The downloaded shell stub first performs a CIS locale check by reading ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources and grepping for 'russian'. If the input source is found, the malware POSTs a cis_blocked telemetry event to its C2 and exits. Otherwise, it retrieves the second-stage AppleScript and executes it via osascript without writing the payload to disk. The second stage prompts the user for their login password (used to decrypt Keychain and browser-stored credentials) under a fake error dialog, then runs the Filegrabber: scanning ~/Desktop and ~/Documents for .docx, .doc, .wallet, .key, .keys, .txt, .rtf, .csv, .xls, .xlsx, .json, and .rdp files under 2MB plus .png images under 6MB, capped at 150MB total. Collected files are staged in /tmp/shub_<random>/. If the staging directory exceeds 85MB, Reaper writes /tmp/shub_split.sh which uses zip to split the archive into 70MB chunks (/tmp/shub_mzip_*.zip) and curls them sequentially to https://hebsbsbzjsjshduxbs[.]xyz/gate/chunk.
Reaper then attempts wallet hijacking against Exodus, Atomic Wallet, Ledger Wallet/Ledger Live, and Trezor Suite. It downloads a tampered app.asar from the C2, kills the active wallet process, and overwrites the legitimate file inside the application bundle. To bypass Gatekeeper on the modified bundle, the script clears extended attributes with 'xattr -cr' and ad-hoc signs the bundle.
Finally, Reaper establishes persistence by creating a directory structure that masquerades as Google's official updater: ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/. It writes a base64-decoded bash script named GoogleUpdate into that path and registers a user LaunchAgent at ~/Library/LaunchAgents/com.google.keystone.agent.plist (mimicking the real com.google.keystone.agent identifier used by Google Software Update / Keystone). The LaunchAgent runs the GoogleUpdate script every 60 seconds; it beacons system details to https://hebsbsbzjsjshduxbs[.]xyz/api/bot/heartbeat. If the C2 response includes a 'code' payload, the beacon base64-decodes it, writes it to /tmp/.c.sh, executes it with the current user's privileges, and deletes the file - giving the operators a persistent fileless backdoor for arbitrary command execution.
Key C2 endpoints observed: https://hebsbsbzjsjshduxbs[.]xyz/api/debug/event (telemetry including cis_blocked), https://hebsbsbzjsjshduxbs[.]xyz/api/bot/heartbeat (beacon/backdoor channel), and https://hebsbsbzjsjshduxbs[.]xyz/gate (and /gate/chunk for staged file uploads). Attribution remains unspecified by SentinelOne, but the CIS locale exclusion via Cyrillic input-source checks is consistent with Russian-speaking criminal stealer ecosystems behind AMOS and earlier SHub builds. Defenders should hunt for: unexpected applescript:// URL handling, AppleScript or osascript spawning curl or zsh with base64-decoded URLs, LaunchAgent creation under com.google.keystone.agent.plist that does not match the legitimate Keystone path (real Keystone lives under /Library/Google or ~/Library/Google/GoogleSoftwareUpdate, not Application Support), staging directories named /tmp/shub_*, and outbound traffic to hebsbsbzjsjshduxbs[.]xyz.
MITRE ATT&CK techniques used in TL-2026-0526
Collection
T1005 Data from Local System; T1074 Data Staged; T1119 Automated Collection; T1560 Archive Collected Data
Exfiltration
T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1217 Browser Information Discovery; T1518 Software Discovery; T1614 System Location Discovery
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Persistence
T1543 Create or Modify System Process; T1546 Event Triggered Execution
defense-impairment
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities
Impact
Affected products and versions in SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4
- Apple — macOS
Vulnerable versions: Tahoe 26.4 and earlier where applescript:// handler is registered to Script Editor - Mozilla — Firefox (credential/cookie theft target)
Vulnerable versions: all - Google — Chrome (credential/cookie theft target)
Vulnerable versions: all - Microsoft — Edge (credential/cookie theft target)
Vulnerable versions: all - Brave Software — Brave Browser
Vulnerable versions: all - Opera — Opera Browser
Vulnerable versions: all - Vivaldi — Vivaldi Browser
Vulnerable versions: all - The Browser Company — Arc
Vulnerable versions: all - Kagi — Orion Browser
Vulnerable versions: all - Exodus Movement — Exodus Wallet
Vulnerable versions: all (app.asar replacement)
Remediation for SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4
Patches
- Apply macOS Tahoe 26.4 or later (mitigates the original Terminal-based ClickFix flow but does not block this applescript:// variant; vendor mitigation pending).
- Update browser password manager / wallet extensions and disable autofill on untrusted domains.
Immediate actions
- Block outbound traffic to hebsbsbzjsjshduxbs[.]xyz, qq-0732gwh22[.]com, mlcrosoft[.]co[.]com, and mlroweb[.]com at proxy/DNS/firewall.
- Hunt for ~/Library/LaunchAgents/com.google.keystone.agent.plist on macOS endpoints and verify it points at the legitimate Google Keystone agent rather than ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate.
- Hunt for staging artifacts: /tmp/shub_*, /tmp/shub_log.zip, /tmp/shub_split.sh, /tmp/shub_mzip_*.zip, /tmp/.c.sh, /tmp/*_asar.zip.
- Search for SHA256 6552824c59ddacb134073f24a4bd4724514a938a9dc59f1733503642faed3bd3 and the string Reaper / c917fcf8314228862571f80c9e4a871e across endpoint telemetry.
Workarounds
- Disable or restrict the applescript:// URL scheme using a custom LaunchServices policy or by removing Script Editor's URL handler registration where feasible.
- Block Script Editor.app from spawning network-capable child processes (curl, zsh, osascript) via an EDR application-control policy.
- Enforce read-only mounts on ~/Library/LaunchAgents for non-privileged users where supported.
Longer-term hardening
- Deploy EDR with behavioral detection for AppleScript / osascript spawning curl or zsh with base64-decoded URLs (Apple File Quarantine alone is insufficient).
- Restrict the applescript:// URL scheme handler at the MDM/configuration-profile level for managed macOS fleets, or use an allow-list of trusted applications.
- Tighten LaunchAgent change-detection: alert on any new com.google.* or com.apple.* LaunchAgent whose ProgramArguments target does not live under a vendor-signed path.
- User awareness training that specifically calls out 'Click Run in Script Editor' prompts as a phishing red flag, parallel to existing ClickFix/Terminal training.
Weaknesses (CWE) in SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4
CWE-829, CWE-94, CWE-78, CWE-77, CWE-506
Timeline of SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4
- SHub Stealer family first publicly documented by Moonlock, Jamf, and Malwarebytes researchers; early builds rely on fake application installers and ClickFix social engineering pasting commands into Terminal.
- SentinelOne previously documents abuse of the applescript:// URL scheme on macOS as a Terminal-bypass technique; Jamf later observes the same primitive in a related campaign.
- Apple ships macOS Tahoe 26.4 mitigation targeting Terminal-based ClickFix attack flows (the prior SHub Stealer delivery method).
- SentinelOne telemetry observes SHub Reaper campaign actively delivering fake WeChat and Miro installers from typo-squatted lure domains; campaign uses applescript:// to bypass the Tahoe 26.4 Terminal mitigation.
- SentinelOne completes IOC collection: primary C2 hebsbsbzjsjshduxbs[.]xyz with /api/debug/event, /api/bot/heartbeat, and /gate endpoints; build hash c917fcf8314228862571f80c9e4a871e and SHA256 6552824c59ddacb134073f24a4bd4724514a938a9dc59f1733503642faed3bd3 confirmed.
- Threadlinqs Intelligence opens TL-2026-0526 to track the SHub Reaper variant independently from earlier SHub Stealer campaign TL-2026-0471.
- SentinelOne (Phil Stokes) publishes 'SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain' with full analysis of delivery, exfiltration, wallet hijacking, persistence backdoor, and IOCs.
- As of 2026-05-29, SHub Reaper remains active: SentinelOne disclosed it 2026-05-18 (corroborated by BleepingComputer, The Register, CSO) with lure domains still serving payloads and C2 hebsbsbzjsjshduxbs[.]xyz live, no takedown reported. No patch exists; Apple's Tahoe 26.4 mitigation does not block the applescript:// variant and a fix is still pending.
- malware-traffic-analysis.net publishes a new SHub Stealer infection traffic capture (pcap, notes, images, and collected-files archives), confirming the campaign remains actively distributed a month after the Reaper disclosure.
Update history for TL-2026-0526
- 2026-07-18 — SHub Stealer (Reaper Variant) — macOS Infostealer with Backdoor Persistence Spoofing Apple, Google, and Microsoft: What changed No severity/exploitability/status change — threat remains HIGH/ACTIVE/ACTIVE, consistent with the existing record. New indicators (0) None — all domains, hashes, C2 endpoints, and file paths in the newer report already exist in
Sources cited for SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4
- SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain
- SentinelOne - prior analysis of applescript:// URL scheme abuse on macOS
- Jamf Threat Labs - applescript:// URL scheme abuse in macOS stealer campaign
- Moonlock Lab - SHub Stealer family overview
- Malwarebytes Labs - macOS infostealers and ClickFix social engineering
- MITRE ATT&CK - T1059.002 AppleScript
- MITRE ATT&CK - T1543.001 Launch Agent
- MITRE ATT&CK - T1539 Steal Web Session Cookie
- Apple - macOS Tahoe 26.4 release notes (Terminal ClickFix mitigation)
Threats related to SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4
- SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and Google-Masquerading LaunchAgent Backdoor
- Fake ChatGPT Download Site openew[.]app — Dual-Platform Delivery: Windows Electron/Inno Setup PowerShell-stdin Loader & macOS Atomic Stealer (AMOS) With Ledger/Trezor Wallet Replacement
- macOS Info-Stealer Chains Fake Password Prompt, Telegram Session Theft, and Crypto Wallet App Replacement
- ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence
- Cross-Platform Node.js NPM Stealer — Browser Credentials, Sensitive File Exfiltration, and WebSocket Reverse Shell (SHA256 049300aa…ddeb9, C2 216.126.225.243)
- macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections
Detection coverage for TL-2026-0526
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0526 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.