Reaper

The attack starts on fake software pages hosted on misspelled Microsoft web domains, such as mlcrosoft.co.com.

the infection vector wraps its payload inside a seemingly normal, signed application installer disguised as standard collaboration tools like Miro or WeChat.

The updated build, now called Reaper, spreads through fake websites that impersonate popular software... It uses a fake webpage to silently open your Mac’s Script Editor, pre-loaded with malicious code, and all a user has to do is click one button to unknowingly launch the infection.

Known as “IoT Troop” or “Reaper”, this threat targets IoT devices by exploiting vulnerabilities on internet-connected devices such as IP cameras and consumer grade routers.

Reaper uses fake WeChat and Miro installers as lures... Instead of forcing text interaction, the infection vector wraps its payload inside a seemingly normal, signed application installer disguised as standard collaboration tools like Miro or WeChat.

Attackers spoof well-known brands and host malware payloads on domains that look nearly identical to legitimate ones. They pass off malware downloads as Apple security updates...

Reaper drops a highly persistent User LaunchAgent script onto the host... The native LaunchAgent configuration is designed to trigger this GoogleUpdate beacon script automatically every 60 seconds, logging system details and checking in with the C2 server’s /api/bot/heartbeat endpoint.

the fake websites use a specific internet link format ( applescript:// ) to automatically open the built-in macOS Script Editor app. The hackers hide the malicious code inside the app by using extensive ASCII art and arbitrary whitespace injection to obfuscate the functional script sequences below the visible scroll boundary

File Name GoogleUpdate Encoded Base64 bash script planted as part of the persistence backdoor

the fake websites use a specific internet link format ( applescript:// ) to automatically open the built-in macOS Script Editor app... When a user clicks the play button, thinking they are running a normal system update, the script executes.

LaunchAgent com.google.keystone.agent.plist LaunchAgent property list used to register and persist the backdoor

Finally, it sets up a permanent backdoor inside a fake Google Software Update directory to maintain remote access to the computer.

LaunchAgent com.google.keystone.agent.plist LaunchAgent property list used to register and persist the backdoor

Finally, it sets up a permanent backdoor inside a fake Google Software Update directory to maintain remote access to the computer.

The hackers hide the malicious code inside the app by using extensive ASCII art and arbitrary whitespace injection to obfuscate the functional script sequences below the visible scroll boundary of the graphical user interface.

the campaign distributing an updated version of SHub Stealer under the build tag Reaper... attackers used fake download pages for popular apps such as WeChat and Miro to target victims.

If the server returns a “code” payload, the script decodes it, writes it to /tmp/.c.sh , runs it with the current user’s privileges, and then deletes it.

Reaper then checks the computer’s keyboard configuration. If the keyboard is set to the Russian language, the program completely shuts down.

Otherwise, it retrieves a second AppleScript containing the core extraction logic and runs it in memory via osascript, never directly touching the local disk.

Once the script runs, it displays a fake Apple security update message to trick the user into typing in their system password.

Earlier builds could already steal browser data, macOS Keychains, iCloud account data, and Telegram session information. The new version goes much further, now targeting Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion browsers, along with their extensions.

Earlier builds could already steal browser data, macOS Keychains, iCloud account data, and Telegram session information.

IoT malware spreads by scanning the Internet for other vulnerable devices... according to research released Oct. 20 by Chinese security firm Netlab 360, the scanning performed by the new IoT malware strain ... is not very aggressive, and is intended to spread much more deliberately than Mirai.

Reaper includes a FileGrabber routine that scans the Desktop and Documents folders for files likely to hold business or financial value.

Reaper then checks the computer’s keyboard configuration. If the keyboard is set to the Russian language, the program completely shuts down.

The malware also carries an AMOS-style Filegrabber that hunts through Desktop and Documents folders for valuable files, including .docx, .wallet, .key, .csv, .xls, and .json formats.

Once the script runs, it displays a fake Apple security update message to trick the user into typing in their system password.

Files are staged in /tmp/shub_random/ before being split into 10MB chunks and uploaded to the attacker’s server via curl.

The malware also targets internet browsers like Chrome, Firefox, and Edge to steal saved passwords, along with browser extensions like 1Password and MetaMask.

specifically storing .docx, .pdf, .xlsx, .wallet , and .keys files into compressed 70MB chunked ZIP archives.

These archives are transmitted via standard curl commands to an external command-and-control server at hebsbsbzjsjshduxbs.xyz/gate/chunk.

Every time the LaunchAgent fires, the script sends system details to the attacker’s /api/bot/heartbeat endpoint. If the server returns a “code” payload, the script decodes it... Reaper includes a FileGrabber routine... uploaded to the attacker’s server via curl.

A global network of millions of hacked IoT devices can be used for a variety of purposes — such as serving as a sort of distributed proxy or anonymity network...

These archives are transmitted via standard curl commands to an external command-and-control server at hebsbsbzjsjshduxbs.xyz/gate/chunk .

Compromised devices could be used to support Distributed Denial of Service attacks (DDoS) against targets worldwide.