[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgDNMcmiIhpu8HUwT47ZpqZ8DriX8x4fQ2n_x07-Kb00":3},{"article":4,"iocs":41,"watch_terms":55,"solutions":56,"lesson":30},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"0505f0c8-c193-44fc-a050-04ac356a7c6d","SHub macOS infostealer variant spoofs Apple security updates","shub-macos-infostealer-variant-spoofs-apple-security-updates-3e6a28","A new variant of the 'SHub' macOS infostealer uses AppleScript to show a fake security update message and installs a backdoor. [...]","A new variant of the SHub macOS infostealer, dubbed 'Reaper,' uses AppleScript and fake Apple security update prompts to trick users into executing malicious code. Unlike earlier ClickFix campaigns that relied on Terminal commands, Reaper leverages the applescript:\u002F\u002F URL scheme to bypass Apple's March 2026 mitigations. The malware steals browser data, cryptocurrency wallets, passwords, documents, and establishes persistence via LaunchAgent for remote access.","SHub macOS infostealer variant 'Reaper' spoofs Apple security updates via AppleScript to steal data and install","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fshub-macos-infostealer-variant-spoofs-apple-security-updates\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F18\u002FApple.jpg","2026-05-18T21:42:20+00:00","2026-05-18T22:00:19.966533+00:00",9,[17,20,22,25],{"name":18,"type":19},"Apple","vendor",{"name":21,"type":19},"SentinelOne",{"name":23,"type":24},"macOS Tahoe 26.4","product",{"name":26,"type":27},"AppleScript","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,36],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46,49,52],{"type":43,"value":44,"context":45},"domain","qq-0732gwh22[.]com","Fake QQ\u002FWeChat installer distribution domain",{"type":43,"value":47,"context":48},"mlcrosoft[.]co[.]com","Fake Microsoft domain serving malicious WeChat installer",{"type":43,"value":50,"context":51},"mlroweb[.]com","Fake Miro platform domain used in SHub Reaper campaign",{"type":32,"value":53,"context":54},"SHub Reaper","New macOS infostealer variant using AppleScript and fake security updates",[18,21,23],{"controls":57,"vendors":130},[58,79,107],{"slug":59,"name":60,"problem":61,"products":62},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[63,71],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":101,"vendor_name":21,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"sentinelone","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":108,"name":109,"problem":110,"products":111},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[112,119,125],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":108,"product_name":116,"url":117,"description":118},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":126,"product_name":127,"url":128,"description":129},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[131],{"slug":101,"name":21,"logo_path":102,"roles":132},[133],"reported_by"]