[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f26TU6pxPQ7Vm2_yN7jRSdhPhBoldFC68zSIGV8yKTAQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38,"controls":39},"072f9fd1-f67c-440d-b417-2f350260b072","macos-infostealer-exploits-fake-downloads-and-script-editor-to-steal-crypto-assets","18ac21d7-6dee-48a4-88f8-4d17ded0438c","macOS Infostealer Exploits Fake Downloads and Script Editor to Steal Crypto Assets","The Reaper malware demonstrates how threat actors exploit user trust by distributing malicious software through convincing fake download pages that mimic legitimate applications like WeChat and Microsoft products. By abusing macOS Script Editor to bypass Terminal security restrictions, the malware successfully steals sensitive cryptocurrency wallets, browser passwords, and exchange credentials. This attack highlights the critical importance of software download verification and the risks of installing applications from unofficial sources, especially when handling high-value digital assets.","**Immediate actions:**\n- Verify all software downloads through official vendor websites and app stores only\n- Enable macOS Gatekeeper and System Integrity Protection to block unauthorized applications\n- Review and remove any recently installed applications from unofficial sources\n\n**Long-term improvements:**\n- Implement application allowlisting to prevent execution of unauthorized software\n- Establish mandatory security awareness training focused on software installation risks\n- Deploy endpoint detection and response (EDR) solutions with behavioral analysis capabilities\n\n**Detection measures:**\n- Monitor for unusual Script Editor activity and unauthorized terminal bypass attempts\n- Implement file integrity monitoring for cryptocurrency wallet applications and browser extensions\n- Set up alerts for suspicious network connections to unknown command and control servers",[12,13,14,15,16],"CIS Control 2.3","CIS Control 7.1","NIST AC-20","NIST SI-3","NIST SI-7",{},"published","2026-06-05T14:20:34.276901+00:00","2026-06-05T14:20:34.189+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fhackread.com\u002Freaper-macos-infostealer-script-editor-crypto-passwords\u002F","reaper-macos-infostealer-abuses-script-editor-to-steal-crypto-and-passwords-1c4860","Reaper macOS Infostealer Abuses Script Editor to Steal Crypto and Passwords",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":33,"name":34,"slug":35,"description":36,"color":37},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[40,44,48],{"slug":41,"name":42,"problem":43},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":45,"name":46,"problem":47},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":49,"name":50,"problem":51},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]