The image that Mac computers remain virtually “invulnerable” to cyberattacks seems to be crumbling at an ever-increasing rate. Security researchers are warning of the emergence of a new and highly sophisticated infostealer called SHub Reaper , which targets macOS users using techniques that resemble advanced state-sponsored attacks more than conventional malware.
The new malware is posing as a legitimate Apple security tool, aiming to trick users into accessing passwords, cryptocurrency wallets, browser data, and sensitive business files. According to SentinelOne, SHub Reaper is the newest and most dangerous version of the SHub Stealer, which has been active for the past two years in campaigns specifically designed for macOS.
SHub Reaper: How the new attack works
Unlike traditional malware that installs itself as an apparently suspicious application, SHub Reaper leverages native macOS tools to “hide” its activity within the normal operation of the system. The new tactic relies on AppleScript and Script Editor , allowing attackers to bypass protection mechanisms recently added by Apple.
See also: Four malicious npm packages with infostealers and DDoS malware
Cybercriminals use the URL scheme applescript://, leading victims to a process that appears perfectly legitimate. Instead of asking the user to execute commands via Terminal, the attack is transferred to the Script Editor, giving the impression of an official macOS security feature.
This strategy is particularly dangerous, as the malware exploits users' trust in Apple tools. In practice, users believe they are installing a security update, while in reality they are triggering a full chain of system compromise.
Fake updates and misleading domains
Attacks are typically launched via malicious websites that mimic well-known services and technology companies. Victims may download fake installers for applications such as WeChat or Miro from domains that resemble official Microsoft infrastructure.
Before the malware is even delivered, websites collect detailed information about the visitor's system . Fingerprinting mechanisms examine WebGL data, active VPNs, browser extensions, virtual machines, and security analysis tools.
The pages also include sophisticated anti-analysis techniques. The malware blocks developer tools, interferes with shortcuts like F12, and creates debug loops that make analysis by security researchers significantly more difficult. In some cases, the page content is replaced with a message in Russian stating "access is denied."
Theft of passwords, crypto wallets and professional files
Once the victim executes the malicious script, a fake Apple XProtectRemediator update, while data-stealing commands are executed in the background. SHub Reaper targets password managerssuch as 1Password, Bitwarden, and LastPass, as well as crypto wallet extensions such as MetaMask and Phantom.
See also: Fast16 Malware: The first cyber sabotage tool before Stuxnet
The list of applications targeted is impressively long. The malware attempts to gain access to Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Orion, while also attacking applications such as Exodus, Atomic Wallet, Ledger Live, Electrum, and Trezor Suite.
In addition to credentials and wallets, SHub Reaper searches for macOS Keychain data, Telegram session information, browser extensions, and developer-related files. Researchers note that the newer version of the malware now has mass document theft capabilities, searching for Word files, spreadsheets, JSON files, and saved remote access settings.
Persistence: The most worrying development
What sets SHub Reaper apart from previous infostealers is its persistence. To date, many macOS stealers have stolen data and quickly disappeared from the system. Reaper, on the other hand, seeks to remain permanently active.
To achieve this, it installs LaunchAgents disguised as legitimate Google components. The attackers create a fake GoogleUpdate.app and activate a LaunchAgent named com.google.keystone.agent.plist, which runs every 60 seconds.
This approach makes it extremely difficult for an average user to detect the malware, as the files look almost identical to real software update services.
See also: DirtyDecrypt: PoC exploit released for Linux vulnerability
Once installed, remote servers can send new commands, additional payloads, or even remote access tools. This means that the initial infection can develop into a long-term compromise of the entire system.
Why the new generation of malware worries experts
The SHub Reaper case reveals a broader shift in the way macOS attacks are being designed. Cybercriminals are no longer relying solely on suspicious executables or obvious trojans. Instead, they are leveraging legitimate tools from Apple, Google, and Microsoft to make malicious activity look completely normal.
This technique, known as “living off the land”, is considered one of the most dangerous trends in cybersecurity, as it drastically reduces the chances of detection by traditional antiviruses.
Experts are warning that Mac users should abandon the notion that macOS is “invulnerable.” The rise of crypto wallets, corporate data, and Mac use in business environments has made the platform a particularly attractive target for organized cybercrime groups.
See also: MiniPlasma: New Windows zero-day worries admins
How Mac users can protect themselves
Security analysts recommend that users avoid installers and scripts from unknown websites, especially when they require manual execution via Script Editor or Terminal. Apple rarely requires such procedures for official security updates.
At the same time, it is recommended to download applications exclusively from the Mac App Store or official developer websites. Suspicious notifications about "failed updates" or unexpected prompts to enter an administrator password should be treated with particular caution.
For more advanced users and system administrators, monitoring AppleScript, osascript, and LaunchAgents activity is also considered important, as well as identifying suspicious folders that imitate well-known vendors such as Google or Microsoft.
SHub Reaper clearly shows that the new generation of macOS malware is no longer based on users' naivety, but on abusing their trust in well-known brands and built-in tools of the operating system itself.
