Cybercriminals targeting macOS users have evolved their tactics in response to Apple's security improvements, developing a sophisticated information-stealing campaign that exploits the built-in Script Editor application to bypass recently implemented Terminal protections.
The latest evolution of the SHub information stealer, known as Reaper, demonstrates how threat actors quickly adapt to security countermeasures. When Apple introduced Terminal-based mitigations in macOS Tahoe 26.4 to prevent users from executing harmful pasted commands, attackers pivoted to a more insidious approach using the applescript:// URL scheme.
Sophisticated Social Engineering Tactics
The attack begins with carefully crafted fake websites that impersonate legitimate software distributors. Victims are lured to domains mimicking popular applications like WeChat and Miro, hosted on deceptively similar URLs designed to fool casual inspection. These sites employ several layers of deception:
What makes this campaign particularly dangerous is its use of dynamic script construction hidden beneath ASCII art, making static analysis more challenging for security tools. The malicious AppleScript payload is assembled on-the-fly, complicating traditional signature-based detection methods.
Multi-Stage Infection Process
Once a victim clicks the malicious download, the attack unfolds through several carefully orchestrated stages. The malware first displays a convincing fake Apple security update notification referencing XProtectRemediator, Apple's legitimate malware remediation tool. This social engineering tactic exploits users' trust in genuine security processes.
The infection process includes an interesting geopolitical element: the malware performs a keyboard layout check and exits immediately if Russian input methods are detected, suggesting the operators wish to avoid targeting users in Russia or former Soviet states.
The sophistication of this attack lies not just in its technical execution, but in its psychological manipulation of users through familiar security update interfaces.
Comprehensive Data Exfiltration
Reaper demonstrates advanced capabilities across multiple attack vectors. The malware specifically targets:
- Browser credentials from eight major applications including Chrome, Firefox, and Edge
- Cryptocurrency wallet extensions such as MetaMask and Phantom
- Password manager data from 1Password, Bitwarden, and LastPass
- Desktop cryptocurrency applications including Exodus and Ledger Live
- iCloud account information and Telegram session data
The malware's "Filegrabber" module searches Desktop and Documents folders for sensitive files, collecting data up to 150MB total with specific size limits designed to avoid detection while maximizing valuable information theft.
Wallet Hijacking Methodology
Perhaps most concerning is Reaper's ability to hijack cryptocurrency wallet applications by replacing legitimate core files with malicious versions. The malware terminates running wallet processes and substitutes the authentic app.asar file with a compromised version downloaded from command-and-control infrastructure.
To evade Apple's Gatekeeper security system, the malware removes quarantine attributes and applies ad hoc code signing to modified application bundles, making the malicious files appear legitimate to the operating system.
Persistent Access and Remote Capabilities
Beyond immediate data theft, Reaper establishes long-term persistence by installing a script that masquerades as Google software updater. This script executes every minute, maintaining a beacon connection to command-and-control servers and enabling remote payload delivery.
This persistence mechanism transforms the malware from a simple information stealer into a potential backdoor, allowing attackers to deploy additional tools or maintain access for extended periods.
What You Should Do
Organizations and individuals can implement several defensive measures to protect against this evolving threat:
- Monitor Script Editor Activity: Implement logging for applescript:// URL scheme usage and unexpected Script Editor launches
- Network Traffic Analysis: Watch for suspicious outbound connections following Script Editor execution
- LaunchAgent Monitoring: Regularly audit new LaunchAgent installations, particularly those impersonating legitimate software vendors
- User Education: Train users to verify software downloads through official channels and be suspicious of unexpected security update prompts
- Browser Extension Auditing: Regularly review installed browser extensions and remove unnecessary cryptocurrency or password management tools
The SHub Reaper campaign illustrates how quickly cybercriminals adapt to security improvements, turning defensive measures into opportunities for new attack vectors. As Apple continues strengthening macOS security, organizations must remain vigilant and implement comprehensive monitoring strategies that go beyond traditional malware detection.
