SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 Terminal Mitigation via applescript:// URL Scheme, Spoofs Apple/Google/Microsoft (SentinelOne) — Threadlinqs Intelligence
As of 2026-07-18, SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 Terminal Mitigation via applescript:// URL Scheme, Spoofs Apple/Google/Microsoft (SentinelOne) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0526 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Updated: 2026-07-18 · revalidated 1× · latest source
SentinelOne disclosed a new SHub Stealer variant tagged 'Reaper' that abandons the ClickFix/Terminal social engineering used by earlier SHub builds in favor of the applescript:// URL scheme, launching
SHub Reaper is a new build of the SHub macOS infostealer family that SentinelOne (Phil Stokes) disclosed on 2026-05-18. The build tag 'Reaper' is embedded in the AppleScript payload alongside the static build hash c917fcf8314228862571f80c9e4a871e and the SHA256 6552824c59ddacb134073f24a4bd4724514a938a9dc59f1733503642faed3bd3. The variant retains the broad credential-stealing capability of earlier SHub builds (browser data from Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion; desktop wallets including Exodus, Atomic, Ledger Live, Electrum, and Trezor Suite; the macOS Keychain and iCloud account data; Telegram session data) but introduces three notable changes that warrant independent tracking from the previously documented SHub Stealer campaign (TL-2026-0471): a Terminal-bypass delivery technique, an AMOS-style document Filegrabber with chunked exfiltration, and a LaunchAgent-based backdoor.
Delivery begins with fake WeChat and Miro installer pages hosted on typo-squatted domains, notably mlcrosoft[.]co[.]com (Microsoft impersonation) along with qq-0732gwh22[.]com (fake WeChat lure) and mlroweb[.]com (fake Miro lure). These pages are not static; embedded JavaScript profiles the visitor's IP address, geolocation, WebGL fingerprint, and indicators of virtual machines or VPNs, enumerates installed browser extensions specifically looking for 1Password, Bitwarden, LastPass, MetaMask, and Phantom, and exfiltrates the collected telemetry to a hardcoded Telegram bot. The pages also implement aggressive anti-analysis: overriding console functions, intercepting F12 and other developer keystrokes, running a continuous debugger loop, and listening for the devtoolschange event to overwrite the page with a Russian-language 'Access Denied' message (<h1>Доступ запрещен</h1>) if DevTools is opened.
The core delivery innovation is the abuse of the applescript:// URL scheme to launch macOS Script Editor (Script Editor.app) pre-populated with the malicious payload, sidestepping Apple's Tahoe 26.4 mitigation that targeted ClickFix attack flows pasting commands into Terminal. The HTML page constructs the payload dynamically, padding it with ASCII art and fake terms so the malicious 'do shell script' line is pushed below the visible portion of the Script Editor window. When the victim clicks 'Run', AppleScript prints a fake update banner referencing Apple's XProtectRemediator update (e.g., https://support.apple.com/downloads/xprotect-remediator-150.dmg) while silently base64-decoding a hidden URL and piping the curl output into zsh.
The downloaded shell stub first performs a CIS locale check by reading ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources and grepping for 'russian'. If the input source is found, the malware POSTs a cis_blocked telemetry event to its C2 and exits. Otherwise, it retrieves the second-stage AppleScript and executes it via osascript without writing the payload to disk. The second stage prompts the user for their login password (used to decrypt Keychain and browser-stored credentials) under a fake error dialog, then runs the Filegrabber: scanning ~/Desktop and ~/Documents for .docx, .doc, .wallet, .key, .keys, .txt, .rtf, .csv, .xls, .xlsx, .json, and .rdp files under 2MB plus .png images under 6MB, capped at 150MB total. Collected files are staged in /tmp/shub_<random>/. If the staging directory exceeds 85MB, Reaper writes /tmp/shub_split.sh which uses zip to split the archive into 70MB chunks (/tmp/shub_mzip_*.zip) and curls them sequentially to https://hebsbsbzjsjshduxbs[.]xyz/gate/chunk.
Reaper then attempts wallet hijacking against Exodus, Atomic Wallet, Ledger Wallet/Ledger Live, and Trezor Suite. It downloads a tampered app.asar from the C2, kills the active wallet process, and overwrites the legitimate file inside the application bundle. To bypass Gatekeeper on the modified bundle, the script clears extended attributes with 'xattr -cr' and ad-hoc signs the bundle.
Finally, Reape
Weaknesses (CWE)
CWE-829, CWE-94, CWE-78, CWE-77, CWE-506
Target sectors: technology, financial, cryptocurrency, developers, small-business, consumer
Target regions: North America, Europe, Asia, Global (CIS excluded)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1583, T1587, T1189, T1566, T1204, T1204, T1059, T1059, T1543