Reaper macOS Malware Spoofs Apple Updates to Steal Passwords and Wallet Data

SentinelOne researchers identified Reaper, a new macOS variant of the SHub infostealer, in campaigns that impersonate Apple security updates and legitimate software such as WeChat and Miro. The malware is delivered through typo-squatted and deceptive domains that use hidden JavaScript and the applescript:// URL scheme to open Script Editor and run concealed commands, presenting victims with a fake XProtectRemediator update prompt. The operation fingerprints visitors, exfiltrates telemetry through Telegram, and appears designed to avoid infecting systems using Russian keyboard input.

Once launched, Reaper downloads additional payloads, prompts users for their macOS password, and steals browser data, password manager contents, cryptocurrency wallet information, iCloud and Telegram data, documents, and selected files. Researchers said it can also hijack wallet applications by replacing core files with malicious payloads, then establish persistence through a LaunchAgent disguised as Google Software Update while polling command-and-control infrastructure every 60 seconds. SentinelOne warned that the malware provides attackers with backdoor access beyond basic infostealing and can bypass protections introduced in macOS Tahoe 26.4.