SHub macOS infostealer variant spoofs Apple security updates
SHub macOS infostealer variant 'Reaper' spoofs Apple security updates via AppleScript to steal data and install
A new variant of the SHub macOS infostealer, dubbed 'Reaper,' uses AppleScript and fake Apple security update prompts to trick users into executing malicious code. Unlike earlier ClickFix campaigns that relied on Terminal commands, Reaper leverages the applescript:// URL scheme to bypass Apple's March 2026 mitigations. The malware steals browser data, cryptocurrency wallets, passwords, documents, and establishes persistence via LaunchAgent for remote access.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Apple?
Get an email when a new story names Apple, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — qq-0732gwh22[.]com
- domain — mlcrosoft[.]co[.]com
- domain — mlroweb[.]com
- malware — SHub Reaper