[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-hunR3NE31Ub_-5skiCCd5b8ssMjGJh1T_UzWYYWFd4":3},{"article":4,"iocs":42,"watch_terms":56,"solutions":57,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"18ac21d7-6dee-48a4-88f8-4d17ded0438c","Reaper macOS Infostealer Abuses Script Editor to Steal Crypto and Passwords","reaper-macos-infostealer-abuses-script-editor-to-steal-crypto-and-passwords-1c4860","Threat actors are deploying an updated SHub Stealer variant named Reaper that exploits the native macOS Script Editor to bypass OS-level protections and compromise cryptocurrency assets.","Threat actors are distributing Reaper, an updated SHub Stealer variant, via fake software download pages (WeChat, Miro, Microsoft) that exploit macOS Script Editor to bypass Apple's Terminal copy-paste restrictions. The malware steals cryptocurrency wallets, browser passwords, documents, and cryptocurrency exchange credentials by modifying wallet application code and exfiltrating files via C2 servers. It specifically targets crypto wallets like Ledger Live, Trezor, and Exodus, as well as browser extensions like MetaMask and 1Password.","Reaper macOS infostealer abuses Script Editor to bypass protections and steal crypto and passwords.","https:\u002F\u002Fhackread.com\u002Freaper-macos-infostealer-script-editor-crypto-passwords\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Freaper-macos-infostealer-script-editor-crypto-passwords-2.jpg","2026-06-05T13:06:01+00:00","2026-06-05T14:00:18.173262+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"macOS Script Editor","product",{"name":21,"type":19},"MetaMask",{"name":23,"type":19},"Ledger Live",{"name":25,"type":19},"Trezor Suite",{"name":27,"type":28},"SentinelOne","vendor",{"name":30,"type":28},"Apple","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",[43,47,50,53],{"type":44,"value":45,"context":46},"domain","hebsbsbzjsjshduxbs.xyz","Command-and-control server used for exfiltrating stolen data via \u002Fgate\u002Fchunk endpoint",{"type":44,"value":48,"context":49},"mlcrosoft.co.com","Typo-squatted Microsoft domain hosting malicious payload and fake security update pages",{"type":35,"value":51,"context":52},"Reaper","Updated SHub Stealer variant targeting macOS users, exploits Script Editor for obfuscation",{"type":35,"value":54,"context":55},"SHub Stealer","Original infostealer; Reaper is an updated variant with AMOS-style document theft module",[30,27,18],{"controls":58,"vendors":142},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":89,"name":90,"problem":91,"products":92},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":118,"name":119,"problem":120,"products":121},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[122,129,135],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":126,"url":127,"description":128},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":118,"product_name":139,"url":140,"description":141},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[143,148],{"slug":144,"name":30,"logo_path":145,"roles":146},"apple","\u002Fvendor-logos\u002Fapple.png",[147],"affected",{"slug":149,"name":27,"logo_path":150,"roles":151},"sentinelone","\u002Fvendor-logos\u002Fsentinelone.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":163},"macos-infostealer-exploits-fake-downloads-and-script-editor-to-steal-crypto-assets","macOS Infostealer Exploits Fake Downloads and Script Editor to Steal Crypto Assets","The Reaper malware demonstrates how threat actors exploit user trust by distributing malicious software through convincing fake download pages that mimic legitimate applications like WeChat and Microsoft products. By abusing macOS Script Editor to bypass Terminal security restrictions, the malware successfully steals sensitive cryptocurrency wallets, browser passwords, and exchange credentials. This attack highlights the critical importance of software download verification and the risks of installing applications from unofficial sources, especially when handling high-value digital assets.",[158,159,160,161,162],"CIS Control 2.3","CIS Control 7.1","NIST AC-20","NIST SI-3","NIST SI-7",{}]