Fake CleanMyMac Website Distributes SHub Stealer via ClickFix on macOS
Malware Intelligence · 2 sources · Updated 4mo ago · First seen Mar 10, 2026
Threat actors are impersonating the popular macOS utility CleanMyMac to distribute SHub Stealer, using the lookalike domain cleanmymacos[.]org to lure users into executing malware. The campaign uses the ClickFix technique, which socially engineers victims into opening Terminal and pasting a command that appears legitimate but ultimately downloads and runs a malicious script; because the user initiates execution, common macOS protections such as Gatekeeper, XProtect, and notarization checks may be bypassed.
Post-infection, SHub Stealer targets high-value data including saved credentials, cookies and autofill data from Safari and numerous Chromium-based browsers, Apple/iCloud artifacts (including Keychain-related data), Telegram session files, Apple Notes data, and a wide range of cryptocurrency wallet extensions. Reporting attributes additional capabilities to SHub beyond basic credential theft, including per-victim tracking, geofencing logic that exits when a Russian-language keyboard is detected (a common CIS-avoidance behavior), and persistence mechanisms such as replacing a crypto wallet app with a trojanized copy and installing a Google Update service–spoofing LaunchAgent to maintain long-term access.
