# SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 Terminal Mitigation via applescript:// URL Scheme, Spoofs Apple/Google/Microsoft (SentinelOne)

> SentinelOne disclosed a new SHub Stealer variant tagged 'Reaper' that abandons the ClickFix/Terminal social engineering used by earlier SHub builds in favor of the applescript:// URL scheme, launching macOS Script Editor pre-populated with a base64-decoded curl|zsh stub to bypass Apple's macOS Tahoe 26.4 Terminal mitigation. The infection layers trusted brands across each stage: payload hosted on a typo-squatted Microsoft domain (mlcrosoft[.]co[.]com), executed under a fake Apple XProtectRemediator update banner, and persisted from a counterfeit Google Software Update LaunchAgent. Reaper adds an AMOS-style Filegrabber with chunked uploads and a persistent backdoor on top of SHub's existing credential/wallet theft, and aborts on CIS hosts via com.apple.HIToolbox.plist input-source checks.

- **Published:** 2026-05-18T12:00:00Z
- **Last reviewed:** 2026-07-18T09:52:26.826Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0526
- **ID:** TL-2026-0526
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SHub Reaper is a new build of the SHub macOS infostealer family that SentinelOne (Phil Stokes) disclosed on 2026-05-18. The build tag 'Reaper' is embedded in the AppleScript payload alongside the static build hash c917fcf8314228862571f80c9e4a871e and the SHA256 6552824c59ddacb134073f24a4bd4724514a938a9dc59f1733503642faed3bd3. The variant retains the broad credential-stealing capability of earlier SHub builds (browser data from Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion; desktop wallets including Exodus, Atomic, Ledger Live, Electrum, and Trezor Suite; the macOS Keychain and iCloud account data; Telegram session data) but introduces three notable changes that warrant independent tracking from the previously documented SHub Stealer campaign (TL-2026-0471): a Terminal-bypass delivery technique, an AMOS-style document Filegrabber with chunked exfiltration, and a LaunchAgent-based backdoor.

Delivery begins with fake WeChat and Miro installer pages hosted on typo-squatted domains, notably mlcrosoft[.]co[.]com (Microsoft impersonation) along with qq-0732gwh22[.]com (fake WeChat lure) and mlroweb[.]com (fake Miro lure). These pages are not static; embedded JavaScript profiles the visitor's IP address, geolocation, WebGL fingerprint, and indicators of virtual machines or VPNs, enumerates installed browser extensions specifically looking for 1Password, Bitwarden, LastPass, MetaMask, and Phantom, and exfiltrates the collected telemetry to a hardcoded Telegram bot. The pages also implement aggressive anti-analysis: overriding console functions, intercepting F12 and other developer keystrokes, running a continuous debugger loop, and listening for the devtoolschange event to overwrite the page with a Russian-language 'Access Denied' message (<h1>Доступ запрещен</h1>) if DevTools is opened.

The core delivery innovation is the abuse of the applescript:// URL scheme to launch macOS Script Editor (Script Editor.app) pre-populated with the malicious payload, sidestepping Apple's Tahoe 26.4 mitigation that targeted ClickFix attack flows pasting commands into Terminal. The HTML page constructs the payload dynamically, padding it with ASCII art and fake terms so the malicious 'do shell script' line is pushed below the visible portion of the Script Editor window. When the victim clicks 'Run', AppleScript prints a fake update banner referencing Apple's XProtectRemediator update (e.g., https://support.apple.com/downloads/xprotect-remediator-150.dmg) while silently base64-decoding a hidden URL and piping the curl output into zsh.

The downloaded shell stub first performs a CIS locale check by reading ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources and grepping for 'russian'. If the input source is found, the malware POSTs a cis_blocked telemetry event to its C2 and exits. Otherwise, it retrieves the second-stage AppleScript and executes it via osascript without writing the payload to disk. The second stage prompts the user for their login password (used to decrypt Keychain and browser-stored credentials) under a fake error dialog, then runs the Filegrabber: scanning ~/Desktop and ~/Documents for .docx, .doc, .wallet, .key, .keys, .txt, .rtf, .csv, .xls, .xlsx, .json, and .rdp files under 2MB plus .png images under 6MB, capped at 150MB total. Collected files are staged in /tmp/shub_<random>/. If the staging directory exceeds 85MB, Reaper writes /tmp/shub_split.sh which uses zip to split the archive into 70MB chunks (/tmp/shub_mzip_*.zip) and curls them sequentially to https://hebsbsbzjsjshduxbs[.]xyz/gate/chunk.

Reaper then attempts wallet hijacking against Exodus, Atomic Wallet, Ledger Wallet/Ledger Live, and Trezor Suite. It downloads a tampered app.asar from the C2, kills the active wallet process, and overwrites the legitimate file inside the application bundle. To bypass Gatekeeper on the modified bundle, the script clears extended attributes with 'xattr -cr' and ad-hoc signs the bundle.

Finally, Reaper establishes persistence by creating a directory structure that masquerades as Google's official updater: ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/. It writes a base64-decoded bash script named GoogleUpdate into that path and registers a user LaunchAgent at ~/Library/LaunchAgents/com.google.keystone.agent.plist (mimicking the real com.google.keystone.agent identifier used by Google Software Update / Keystone). The LaunchAgent runs the GoogleUpdate script every 60 seconds; it beacons system details to https://hebsbsbzjsjshduxbs[.]xyz/api/bot/heartbeat. If the C2 response includes a 'code' payload, the beacon base64-decodes it, writes it to /tmp/.c.sh, executes it with the current user's privileges, and deletes the file - giving the operators a persistent fileless backdoor for arbitrary command execution.

Key C2 endpoints observed: https://hebsbsbzjsjshduxbs[.]xyz/api/debug/event (telemetry including cis_blocked), https://hebsbsbzjsjshduxbs[.]xyz/api/bot/heartbeat (beacon/backdoor channel), and https://hebsbsbzjsjshduxbs[.]xyz/gate (and /gate/chunk for staged file uploads). Attribution remains unspecified by SentinelOne, but the CIS locale exclusion via Cyrillic input-source checks is consistent with Russian-speaking criminal stealer ecosystems behind AMOS and earlier SHub builds. Defenders should hunt for: unexpected applescript:// URL handling, AppleScript or osascript spawning curl or zsh with base64-decoded URLs, LaunchAgent creation under com.google.keystone.agent.plist that does not match the legitimate Keystone path (real Keystone lives under /Library/Google or ~/Library/Google/GoogleSoftwareUpdate, not Application Support), staging directories named /tmp/shub_*, and outbound traffic to hebsbsbzjsjshduxbs[.]xyz.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1218 System Binary Proxy Execution
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1217 Browser Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1119 Automated Collection
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1030 Data Transfer Size Limits
- T1657 Financial Theft

## Sources

- [SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain](https://www.sentinelone.com/blog/shub-reaper-macos-stealer-spoofs-apple-google-and-microsoft-in-a-single-attack-chain/)
- [SentinelOne - prior analysis of applescript:// URL scheme abuse on macOS](https://www.sentinelone.com/labs/)
- [Jamf Threat Labs - applescript:// URL scheme abuse in macOS stealer campaign](https://www.jamf.com/blog/jamf-threat-labs/)
- [Moonlock Lab - SHub Stealer family overview](https://moonlock.com/blog)
- [Malwarebytes Labs - macOS infostealers and ClickFix social engineering](https://www.malwarebytes.com/blog/threat-intelligence)
- [MITRE ATT&CK - T1059.002 AppleScript](https://attack.mitre.org/techniques/T1059/002/)
- [MITRE ATT&CK - T1543.001 Launch Agent](https://attack.mitre.org/techniques/T1543/001/)
- [MITRE ATT&CK - T1539 Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [Apple - macOS Tahoe 26.4 release notes (Terminal ClickFix mitigation)](https://support.apple.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0526