Reaper macOS Infostealer Abuses Script Editor to Steal Crypto and Passwords
Reaper macOS infostealer abuses Script Editor to bypass protections and steal crypto and passwords.
Threat actors are distributing Reaper, an updated SHub Stealer variant, via fake software download pages (WeChat, Miro, Microsoft) that exploit macOS Script Editor to bypass Apple's Terminal copy-paste restrictions. The malware steals cryptocurrency wallets, browser passwords, documents, and cryptocurrency exchange credentials by modifying wallet application code and exfiltrating files via C2 servers. It specifically targets crypto wallets like Ledger Live, Trezor, and Exodus, as well as browser extensions like MetaMask and 1Password.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Apple?
Get an email when a new story names Apple, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Reaper malware demonstrates how threat actors exploit user trust by distributing malicious software through convincing fake download pages that mimic legitimate applications like WeChat and Microsoft products. By abusing macOS Script Editor to bypass Terminal security restrictions, the malware successfully steals sensitive cryptocurrency wallets, browser passwords, and exchange credentials. This attack highlights the critical importance of software download verification and the risks of installing applications from unofficial sources, especially when handling high-value digital assets.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — hebsbsbzjsjshduxbs.xyz
- domain — mlcrosoft.co.com
- malware — Reaper
- malware — SHub Stealer