Reaper macOS Infostealer Uses Script Editor to Steal Passwords and Crypto

Researchers reported a macOS malware campaign distributing an updated SHub Stealer variant, dubbed Reaper, through fake download pages impersonating trusted software such as WeChat and Miro. The infection chain uses an automated ClickFix-style technique that avoids Terminal paste protections in macOS by opening the built-in Script Editor through an applescript:// link with malicious code already loaded, requiring only a single user action to run. The malware then presents a fake Apple security update prompt to capture the victim’s password while using typo-squatted domains and brand impersonation to make the attack appear legitimate.

Once executed, Reaper steals documents, browser credentials from Chrome, Firefox, Brave, Edge, and Opera, along with Keychain and iCloud-related data, Telegram sessions, and cryptocurrency wallet information. It exfiltrates files in chunked ZIP archives to attacker-controlled infrastructure, including via curl, modifies legitimate desktop crypto wallet applications to redirect future funds, and establishes persistence through a fake Google Software Update service. Researchers also said the malware checks for a Russian keyboard layout and exits if detected, and noted that this is the third observed automated ClickFix-style macOS campaign in less than two months, indicating the technique is gaining traction among macOS threat actors.