SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and Google-Masquerading LaunchAgent Backdoor
SHub Stealer "Reaper" (TL-2026-1475), also tracked as SHub Reaper, is a high-severity malware campaign, first published 2026-07-18. It is attributed to SHub Stealer operators with low confidence, affects Apple macOS, maps to 33 MITRE ATT&CK techniques (T1005, T1036.005, T1041), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-1475
- Threat ID
- TL-2026-1475
- Also known as
- SHub Reaper, Reaper Stealer, SHub Stealer Reaper variant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution
- SHub Stealer operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- individuals, cryptocurrency, technology, finance
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in SHub Stealer "Reaper"
Malware and tooling: SHub Reaper, SHub Stealer, Telegram bot (hardcoded)
Reaper, the newest variant of the SHub Stealer macOS infostealer family, abuses the applescript:// URL scheme to launch Script Editor with hidden malicious payloads, bypassing Apple's Terminal-based (ClickFix) mitigations added in macOS Tahoe 26.4. Delivered via fake WeChat/Miro installer sites and typo-squatted domains, it harvests browser credentials, Keychain/iCloud data, password-manager and crypto-wallet contents, and documents, then installs a LaunchAgent disguised as Google Software Update for persistent remote code execution.
How SHub Stealer "Reaper" works
SHub Reaper is a multi-stage macOS infostealer, the latest variant in the SHub Stealer family that has circulated in macOS-focused criminal campaigns for roughly two years. It was first documented by SentinelOne on 2026-05-18 and confirmed still active in the wild via a malware-traffic-analysis.net capture dated 2026-06-22.
The infection begins on fake installer websites impersonating WeChat and Miro, hosted on typo-squatted/lookalike domains (qq-0732gwh22[.]com, mlcrosoft[.]co[.]com, mlroweb[.]com). Rather than the increasingly detected Terminal-based "ClickFix" social-engineering pattern, these sites invoke an applescript:// URL to directly launch macOS Script Editor with a pre-populated payload. The malicious AppleScript command is padded with ASCII art and fake terms-of-service text so the actual payload sits below the visible window, and the visible portion displays a spoofed Apple XProtectRemediator update notice urging the victim to click "Run." This delivery mechanism was specifically engineered to bypass the Terminal-based mitigations Apple introduced in macOS Tahoe 26.4 for prior ClickFix-style attacks, since it never touches Terminal at all.
Once running, the AppleScript silently executes a curl command to fetch a first-stage shell script. Before proceeding, the malware performs anti-analysis/geofencing: it queries com.apple.HIToolbox.plist for a Russian keyboard layout, and if the host appears to be in a CIS region it emits a cis_blocked telemetry event to the operator's Telegram bot and exits without deploying further payloads — a deliberate operational-security control consistent with an actor based in or tied to the CIS/Russian-speaking cybercrime ecosystem.
The delivery websites themselves carry heavy anti-analysis tooling: device fingerprinting (IP, geolocation, WebGL fingerprinting, VM/VPN detection), enumeration of installed browser extensions to detect password managers (1Password, Bitwarden, LastPass) and crypto wallet extensions (MetaMask, Phantom), and developer-tools obstruction (console override, F12 interception, continuous debugger statements, a Russian-language "Access Denied" overlay if DevTools are opened). All collected telemetry is exfiltrated to a hardcoded Telegram bot rather than the primary C2, separating reconnaissance/analytics traffic from payload C2 traffic.
Once the victim runs the AppleScript, it social-engineers the user into entering their macOS account password (framed as required to "decrypt" stored data), which is captured and used to unlock Keychain. Reaper then harvests: browser data across Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion; desktop cryptocurrency wallets Exodus, Atomic Wallet, Ledger Live, Electrum, and Trezor Suite, plus browser-extension wallets MetaMask and Phantom; macOS Keychain and iCloud credentials; Telegram session data; and a broad set of documents.
A new Filegrabber module, resembling functionality seen in Atomic macOS Stealer (AMOS), searches the Desktop and Documents folders for files matching extensions .docx, .doc, .wallet, .key, .txt, .rtf, .csv, .xls, .xlsx, .json, and .rdp (under 2MB), plus .png images (under 6MB), subject to a 150MB total collection cap. Collected files are staged under /tmp/shub_<random>/ and zipped; if the staged archive exceeds 85MB, a helper script at /tmp/shub_split.sh chunks it into 70MB ZIP segments (/tmp/shub_mzip_*.zip) that are sequentially uploaded via curl to hebsbsbzjsjshduxbs[.]xyz/gate/chunk.
Separately, Reaper performs active cryptocurrency-wallet hijacking: it locates installed Exodus, Atomic Wallet, Ledger, and Trezor Suite applications, downloads a trojanized app.asar replacement from the C2, terminates the running wallet process, and overwrites the legitimate application bundle file with the malicious asar. To make the replacement executable under macOS Gatekeeper, it strips the quarantine extended attribute with `xattr -cr` and applies an ad hoc code signature to the tampered bundle.
Before terminating, Reaper establishes persistence and a long-term backdoor. It recreates a directory structure mimicking Google's legitimate software-update path — ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/ — and drops a Base64-decoded bash script there named GoogleUpdate. It registers a LaunchAgent, ~/Library/LaunchAgents/com.google.keystone.agent.plist, that executes this script every 60 seconds. The script beacons to hebsbsbzjsjshduxbs[.]xyz/api/bot/heartbeat with host/system details; if the C2 responds with a code payload, the script decodes it, writes it to the ephemeral file /tmp/.c.sh, executes it with the logged-in user's privileges, and immediately deletes the file — giving the operator arbitrary, low-footprint remote code execution on infected hosts indefinitely after the initial infostealer run completes, effectively converting a one-shot infostealer infection into a persistent RAT capability disguised inside a trusted vendor namespace.
SentinelOne's Singularity platform detects the campaign behaviorally: suspicious osascript/AppleScript execution followed by unexpected outbound network activity, unauthorized LaunchAgent creation inside vendor-branded (Google/Apple) paths, and the characteristic staging/chunking file activity under /tmp, without relying on static file-hash signatures.
MITRE ATT&CK techniques used in TL-2026-1475
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1119 Automated Collection; T1560 Archive Collected Data
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1497.001 System Checks; T1535 Unused/Unsupported Cloud Regions
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Credential Access
T1056 Input Capture; T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery; T1614 System Location Discovery
Persistence
T1543.001 Launch Agent; T1547.013 XDG Autostart Entries
defense-impairment
T1553.001 Gatekeeper Bypass; T1685 Disable or Modify Tools
Initial Access
Resource Development
Reconnaissance
T1592.004 Client Configurations
Impact
Affected products and versions in SHub Stealer "Reaper"
- Apple — macOS
Vulnerable versions: macOS Tahoe 26.4 and prior with Terminal-based ClickFix mitigations, all versions supporting applescript:// URL scheme handling and Script Editor
Remediation for SHub Stealer "Reaper"
Immediate actions
- Block the applescript:// URL scheme from launching Script Editor via untrusted browser-invoked links where feasible (browser/OS content-filtering policy)
- Block C2 domain hebsbsbzjsjshduxbs[.]xyz and known lure domains (qq-0732gwh22[.]com, mlcrosoft[.]co[.]com, mlroweb[.]com) at DNS/proxy
- Hunt for and remove ~/Library/LaunchAgents/com.google.keystone.agent.plist and ~/Library/Application Support/Google/GoogleUpdate.app on macOS endpoints that do not have legitimate Google software installed
- Force-rotate credentials for any user who ran an AppleScript from a browser-invoked applescript:// link, including macOS account password, browser-saved passwords, and Keychain-protected secrets
- Move cryptocurrency wallet funds from any wallet application present on a suspected-infected host to a new wallet on a clean device
Workarounds
- Disable or restrict handling of the applescript:// URL scheme at the OS/browser level for unmanaged/BYOD macOS fleets
- Restrict outbound curl/network access from Script Editor and osascript via application-level firewall rules
Longer-term hardening
- Deploy EDR/XDR with behavioral detection for osascript/Script Editor spawning network connections and for LaunchAgent creation events in vendor-branded namespaces
- Enforce application allow-listing and Gatekeeper/notarization checks; alert on xattr quarantine-attribute removal on wallet application bundles
- User-awareness training specifically covering applescript:// / URL-scheme-invoked "paste and run" social engineering, since it no longer relies on Terminal
- Deploy DNS filtering / brand-protection monitoring for typo-squatted domains resembling WeChat, Miro, and Microsoft
Timeline of SHub Stealer "Reaper"
- SHub Stealer family reportedly begins circulating in macOS-focused criminal campaigns (per SentinelOne, active roughly two years prior to the Reaper variant report).
- Apple ships Terminal-based mitigations in macOS Tahoe 26.4 targeting prior ClickFix-style social-engineering attack chains, prompting SHub operators to pivot delivery methods.
- Same-day coverage of the SentinelOne findings published by Forbes and AppleInsider.
- SentinelOne documents the full sequential attack chain: fake WeChat/Miro installer lure -> applescript:// delivery opening Script Editor with a padded payload -> hidden curl-fetched shell-script stub -> CIS-region locale/geofencing check via com.apple.HIToolbox.plist -> osascript-executed exfiltration logic -> AppleScript password-entry dialog to unlock Keychain -> browser/wallet/document harvesting and staging -> app.asar wallet-application replacement -> LaunchAgent persistence -> GoogleUpdate-disguised heartbeat backdoor executing /tmp/.c.sh payloads every 60 seconds.
- SentinelOne publishes 'SHub Reaper' research detailing the applescript:// URL-scheme delivery mechanism, filegrabber module, wallet-hijacking capability, and Google-masquerading LaunchAgent backdoor.
- SentinelOne's report credits earlier SHub Stealer documentation by Moonlock, Jamf, and Malwarebytes, which had already tracked the family's evolution through fake application installers and Terminal-based 'ClickFix' social engineering prior to the Reaper variant.
- Follow-on security-media coverage of the SHub Reaper findings spreads to BleepingComputer, The Register, CSO Online, Help Net Security, SOC Prime, Memeburn, and TechNadu.
- Malware-Traffic-Analysis.net publishes a live infection traffic capture confirming SHub Stealer remains actively delivered in the wild over a month after public disclosure.
- Threadlinqs Intelligence compiles consolidated research and detection coverage for the SHub Reaper campaign.
Sources cited for SHub Stealer "Reaper"
- SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain
- Malware-Traffic-Analysis.net — SHub Stealer macOS infection (2026-06-22)
- New infostealer malware hides on Mac disguised as official Apple tools
- SHub Reaper Targets macOS with Fake Brand Installers
- New macOS infostealer impersonates Apple, Microsoft, and Google in a single attack chain
- SHub macOS infostealer variant spoofs Apple security updates
- SHub Reaper: The new Mac malware spoofing Apple, Google, and Microsoft
- SHub Reaper impersonates Apple, Google, and Microsoft in one MacOS attack chain
- New Mac Password Stealer Impersonates Apple, Google And Microsoft
- Do fear the Reaper - stealer swipes macOS users' passwords, wallets, then backdoors them
- Reaper macOS Stealer Bypasses Tahoe 26.4 Defenses
Threats related to SHub Stealer "Reaper"
- SHub Reaper - macOS Stealer Variant Bypasses Tahoe 26.4 Terminal Mitigation via applescript:// URL Scheme, Spoofs Apple/Google/Microsoft (SentinelOne)
- macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
- ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs to Coerce Credentials
- Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
- ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence
- MacSync Stealer: 'ClaudeFix' Malvertising Campaign Abuses Shared Claude Chat Links to Deploy macOS Infostealer
Detection coverage for TL-2026-1475
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1475 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1475
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.