SHub Reaper: The macOS Malware Impersonating Apple, Google, and Microsoft

June 7, 2026

A new macOS infostealer called SHub Reaper is actively targeting Apple users through a sophisticated multi-stage attack chain. The malware simultaneously impersonates Apple, Microsoft, and Google to harvest sensitive data from compromised machines. SentinelLabs publicly documented the threat in mid-May 2026.

How the SHub Reaper Attack Chain Works

Fake Sites and Typosquatted Domains

The attack begins with fraudulent installation websites. Threat actors replicate download pages for popular applications such as WeChat and Miro, leveraging typosquatted domains — including mlcrosoft[.]co[.]com — to deceive unsuspecting victims.

Users believe they are downloading legitimate software. In reality, they are triggering a multi-stage infection chain. The visual deception is highly convincing and difficult to detect at a glance.

Bypassing Apple Tahoe 26.4 Protections

This is one of the most technically significant aspects of the threat. Apple had introduced mitigations in macOS Tahoe 26.4 specifically targeting ClickFix-style attacks — techniques that trick users into pasting commands directly into the Terminal.

SHub Reaper sidesteps these defenses entirely. It abuses the applescript:// URL scheme to launch the macOS Script Editor, loading a malicious AppleScript payload without ever touching the Terminal. Apple’s mitigations are effectively neutralized, and the malicious code executes silently — the user sees nothing out of the ordinary.

Data Theft and the Filegrabber Module

Credential Harvesting and Sensitive Data Collection

Once executed, the malware presents a fake system dialog box prompting the victim to enter their macOS login password. Armed with that credential, SHub Reaper decrypts and exfiltrates data from:

Browsers and password managers
iCloud and Telegram sessions
Multiple cryptocurrency wallets

The malware also features a Filegrabber module closely resembling that of Atomic macOS Stealer (AMOS). This component scans the Desktop and Documents folders for files relevant to business and financial activity.

File Types in the Crosshairs

Targeted formats include .docx, .doc, .wallet, .key, .xls, .xlsx, .json, .csv, .rdp, and .txt files. The malware enforces precise collection limits: up to approximately 2 MB per document and 6 MB per .png image, with total exfiltration capped at around 150 MB. Stolen data is compressed into roughly 70 MB ZIP archives before being transmitted to the command-and-control (C2) server.

This threat is especially serious for organizations with remote workers, given that financial documents and crypto wallets are among the primary targets.

Persistence and Remote Backdoor

The Fake Google Software Update

Following data theft, SHub Reaper installs a persistent backdoor by creating a spoofed directory designed to mimic Google Software Update:

~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/

Inside this directory, the malware drops a bash script named GoogleUpdate, which is then registered as a LaunchAgent using the identifier com.google.keystone.agent.plist. The LaunchAgent fires every 60 seconds, ensuring continuous execution.

C2 Communication

Concurrently, the script sends heartbeat signals to a command-and-control endpoint (/api/bot/heartbeat). If the server responds with a payload labeled “code,” the script decodes and executes it with the privileges of the compromised user.

What makes this mechanism particularly alarming is its flexibility. Operators can push any arbitrary command to infected systems, effectively transforming what begins as a data-theft operation into a full system compromise.

Guidance for Security Teams

SHub Reaper marks a meaningful evolution in the macOS threat landscape. No specific threat actor has been officially attributed, though operators are linked to the broader SHub malware family.

CISOs and security teams should take concrete action:

Block typosquatted domains at the DNS filtering layer
Monitor for suspicious LaunchAgents, especially those mimicking Google Keystone
Inspect traffic to /api/bot/heartbeat endpoints
Train users never to enter their macOS password into unexpected dialog boxes

Organizations running macOS in enterprise environments should conduct an immediate review of their endpoint security policies. This threat is live and actively evolving.

Sources

The rise of advanced infostealers like SHub Reaper underscores just how critical timely threat intelligence sharing has become for organizations of all sizes. IsacChain enables ISACs and enterprises to exchange indicators of compromise securely and with blockchain-verified integrity, dramatically cutting incident response times. The platform’s built-in automated NIS2 compliance capabilities also allow security teams to document every response action without adding operational overhead. Discover how IsacChain can help your organization at www.isacchain.com