SHub Stealer

Hosting Layer: The secondary payload packages are hosted on typo-squatted web domains mimicking legitimate Microsoft infrastructure.

the infection vector wraps its payload inside a seemingly normal, signed application installer disguised as standard collaboration tools like Miro or WeChat.

The updated build, now called Reaper, spreads through fake websites that impersonate popular software... It uses a fake webpage to silently open your Mac’s Script Editor, pre-loaded with malicious code, and all a user has to do is click one button to unknowingly launch the infection.

"...publishing malicious GitHub repos that deploy infostealers on Windows and macOS."

Reaper uses fake WeChat and Miro installers as lures... Instead of forcing text interaction, the infection vector wraps its payload inside a seemingly normal, signed application installer disguised as standard collaboration tools like Miro or WeChat.

Attackers spoof well-known brands and host malware payloads on domains that look nearly identical to legitimate ones. They pass off malware downloads as Apple security updates...

I decided instead to focus on their fake apps they download ... set asarUrl to gateUrl & "/exodus-asar" ... "/atomic-asar" ... "/ledger-asar" ... "/ledgerlive-asar" ... "/trezor-asar"

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist).

Initial commands leverage curl to fetch obfuscated payloads, which are piped directly into shell interpreters (bash/zsh), minimizing the disk footprint.

ClickFix variant that uses the applescript:// URL scheme to invoke the macOS Script Editor... This URL-encoded hyperlink runs a dual-track routine... while silently executing the curl command in the background to deliver an infostealer, bypassing Gatekeeper via user-coerced interaction.

Monitor Terminal usage : Alert on suspicious Terminal or shell sessions spawned by installers or user apps.

It arrives as a command pasted into Terminal... The front end is ClickFix... fake Cloudflare CAPTCHA banner... They exist to reassure someone who has just pasted a command into a terminal.

Attackers exploit this trust by providing malicious command strings that mimic legitimate installation procedures.

These posts promise to solve common macOS problems... but they instruct users to open Terminal and paste in a command. Once that command runs, it quietly downloads and executes an infostealer in the background.

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist).

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist). This service runs every 60 seconds.

LaunchAgent com.google.keystone.agent.plist LaunchAgent property list used to register and persist the backdoor

For persistence, the campaigns use LaunchAgents and LaunchDaemons, which are background processes that start automatically on every boot.

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist).

The malware establishes persistence by creating a fake Google Update application and installing a LaunchAgent (com.google.keystone.agent.plist). This service runs every 60 seconds.

LaunchAgent com.google.keystone.agent.plist LaunchAgent property list used to register and persist the backdoor

For persistence, the campaigns use LaunchAgents and LaunchDaemons, which are background processes that start automatically on every boot.

The malware then shows a fake box asking for a system password to install a helper tool. If provided, the hackers gain full access to files and settings.

line 13 displays an obfuscated curl command that uses the native tr utility to dynamically decode a hidden URL

The campaign targets macOS users through fake utility and troubleshooting-themed lures.

Detect native tool abuse: Flag unusual sequences of macOS utilities (curl, Base64, Gunzip, osascript, and dscl).

It then checks whether the infected system uses a Russian keyboard layout (a common CIS geofencing technique). If a Russian keyboard is detected, the script sends a "cis_blocked" telemetry event to the command-and-control server and terminates immediately.

piping the payload directly into zsh for memory-resident execution to avoid disk detection.

By presenting deceptive "fixes," "verifications," or installation prompts, adversaries induce users to manually execute malicious scripts via native utilities such as the Terminal or Script Editor.

"Ledger Wallet and Ledger Live have TLS validation disabled at startup"

The soft ask is an osascript dialog... whatever gets typed is checked against dscl /Local/Default -authonly first

The malware attempts to steal the macOS login password. It displays a fake “System Preferences” dialog (with the official LockedIcon) up to 10 times, asking the user to enter their password.

Exfiltration efforts focus on high-value data, including ... messaging session tokens (Telegram/Discord)

Earlier builds could already steal browser data, macOS Keychains, iCloud account data, and Telegram session information. The new version goes much further, now targeting Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion browsers, along with their extensions.

The malware can collect Keychain data, browser information, iCloud data, media files, and cryptocurrency wallet credentials.

Exfiltration efforts focus on high-value data, including ... macOS Keychains

Exfiltration efforts focus on high-value data, including browser credentials (Chromium/Firefox)

Protect credential stores: Detect unauthorized access to keychain items, browser data, SSH keys, and cloud credentials.

The first thing the loader does is system fingerprinting by collecting the hostname, macOS version, external IP address, and keyboard layout information.

Sensitive assets are staged in temporary directories (e.g., /tmp/shub_), compressed, and exfiltrated via encrypted HTTPS channels.

It then checks whether the infected system uses a Russian keyboard layout (a common CIS geofencing technique). If a Russian keyboard is detected, the script sends a "cis_blocked" telemetry event to the command-and-control server and terminates immediately.

if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then IS_CIS="true" fi ... if [ "$IS_CIS" = "true" ]; then send_debug_event "cis_blocked" ... exit 0 fi

The malware also carries an AMOS-style Filegrabber that hunts through Desktop and Documents folders for valuable files, including .docx, .wallet, .key, .csv, .xls, and .json formats.

The malware attempts to steal the macOS login password. It displays a fake “System Preferences” dialog (with the official LockedIcon) up to 10 times, asking the user to enter their password.

The malware stages collected data under a /tmp/shub_<random ID>/ folder.

Clicking on fake streaming links can result in full device compromise, including silent theft of passwords, banking credentials, browser sessions, and crypto wallets with a persistent backdoor left running in the background.

Monitor data staging: Alert on archive creation of sensitive artifacts followed by HTTP POST exfiltration.

In the script campaign, the malware searches for a live command-and-control server, and if none respond, it falls back to a Telegram bot to locate one dynamically.

The native LaunchAgent configuration is designed to trigger this GoogleUpdate beacon script automatically every 60 seconds, logging system details and checking in with the C2 server’s /api/bot/heartbeat endpoint.

The C2 server can return Base64-encoded instructions, which the script decodes and executes locally... We observed data exfiltration to the attacker’s infrastructure on a C2/upload.php endpoint leveraging curl.

Inspect outbound downloads: Monitor curl activity fetching encoded or compressed payloads from unknown domains.

Once com.google.keystone.agent.plist loads, it functions as a backdoor-style bot component that registers the infected macOS system with attacker infrastructure at <C2 domain>/api/bot/heartbeat

Once it collects everything, Reaper bundles the stolen data and quietly sends it to an attacker-controlled server using curl, a legitimate macOS command.

Monitor data staging: Alert on archive creation of sensitive artifacts followed by HTTP POST exfiltration.

“downloads a replacement app.asar… overwrites the original… strips the code signature, and re-signs the app…”