SHub ‘Reaper’ macOS Infostealer Uses Fake Apple Updates to Steal Data
Summary
SentinelOne describes Reaper, a SHub macOS infostealer that uses a fake Apple update and malicious AppleScript to steal credentials, wallet and browser data, and files, while establishing LaunchAgent persistence and enabling additional payloads.
Key points
- Reaper is a SHub variant distributed through fake WeChat and Miro installers; malicious applescript:// links open Script Editor with a prepared AppleScript.
- The script displays a fake XProtectRemediator update, downloads a shell script with curl, and runs it silently with zsh. Reaper exits if it detects a Russian keyboard or input setting.
- After prompting for the macOS password, it targets browser and wallet data, password-manager extensions, iCloud and Telegram session data, developer files, and selected Desktop and Documents files.
- For installed wallet applications, Reaper can replace the core application file with a malicious app.asar, clear quarantine attributes, and apply ad hoc code signing.
- A LaunchAgent runs a script impersonating a Google software updater every minute to beacon system information and receive and execute additional payloads.
- The malicious sites fingerprint devices and installed browser extensions; telemetry is sent to the attacker through a Telegram bot.
- SentinelOne recommends monitoring suspicious outbound traffic after Script Editor execution and looking for unexpected LaunchAgents and related files.
Article Details
- Attack Vectors
- Fake installer websites impersonate WeChat and Miro to lure macOS users.
- An applescript:// link opens Script Editor with malicious AppleScript, which displays a fake Apple security update and silently runs a downloaded shell script.
- Reaper prompts for the macOS password, steals browser, wallet, iCloud, Telegram-session, and local-file data, and can replace wallet application files with a downloaded malicious app.asar.
- A LaunchAgent runs an updater-impersonating script every minute to beacon system information and receive and execute additional payloads.
- Defensive Notes
- SentinelOne recommends monitoring for suspicious outbound traffic after Script Editor execution.
- Monitor for new LaunchAgents and related files appearing under trusted-vendor namespaces.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mlcrosoft[.]co[.]com | Microsoft-impersonating domain in the fake-installer campaign; the article reports that it still serves fake WeChat installers. |
| DOMAIN | mlroweb[.]com | Domain impersonating Miro in the fake-installer campaign; the article reports that it currently redirects to the legitimate Miro website. |
| DOMAIN | qq-0732gwh22[.]com | Fake-installer campaign domain that reportedly still serves fake WeChat installers. |
MITRE ATT&CK
T1005 · Data from Local SystemThe Filegrabber searches Desktop and Documents for targeted files and collects selected files under specified size limits.T1027 · Obfuscated Files or InformationThe command that fetches the payload is constructed dynamically and hidden under ASCII art.T1036.005 · Match Legitimate Resource Name or LocationThe persistence script impersonates a Google software update.T1059.002 · AppleScriptReaper uses an applescript:// link to open Script Editor with malicious AppleScript and later runs the data-theft routine with osascript.T1059.004 · Unix ShellThe malware downloads a shell script with curl and silently executes it using zsh.T1082 · System Information DiscoveryThe LaunchAgent beacon sends system information to the C2 server.T1105 · Ingress Tool TransferReaper downloads a shell script and can retrieve additional payloads from its C2 server.T1497.001 · System ChecksBefore invoking the AppleScript, the malicious websites check for virtual machines and VPNs as possible signs of an analysis environment.T1518 · Software DiscoveryThe malicious websites enumerate installed browser extensions, including password managers and cryptocurrency wallets.T1543.001 · Launch AgentReaper establishes persistence by registering an updater-impersonating script with LaunchAgent.T1555.001 · KeychainThe malware prompts for the macOS password to access Keychain items and decrypt credentials.T1555.003 · Credentials from Web BrowsersReaper targets browser data from multiple browsers and password-manager and cryptocurrency-wallet browser extensions.
Malware
ReaperThe new SHub variant, dubbed Reaper, uses a fake macOS security update via AppleScript to install a backdoor and steal browser, wallet, and system data.SHubThe new SHub variant, dubbed Reaper, uses a fake macOS security update via AppleScript to install a backdoor and steal browser, wallet, and system data.
Products
KeychainUpon launch, it prompts the user for their macOS password, which can then be used to access Keychain items, decrypt credentials, and access protected data.macOSThe new SHub variant, dubbed Reaper, uses a fake macOS security update via AppleScript to install a backdoor and steal browser, wallet, and system data.MetaMaskCryptocurrency wallet browser extensions, including MetaMask and PhantomMirothe new SHub infostealer variant and found that users were lured with a fake installer for WeChat and Miro applications hosted on domains made to appear legitimate to less experienced users (e.g.,PhantomCryptocurrency wallet browser extensions, including MetaMask and PhantomScript EditorIt uses applescript:// links to open Script Editor with malicious AppleScript.TelegramIt also hides its activity with anti-analysis checks, persistence via LaunchAgent, and payload delivery through Telegram-controlled infrastructure.WeChatidentified the new SHub infostealer variant and found that users were lured with a fake installer for WeChat and Miro applications hosted on domains made to appear legitimate to less experienced users (e.g.,XProtectRemediatorWhen the victim clicks ‘Run,’ the script displays a fake Apple security update message referencing XProtectRemediator, downloads a shell script using ‘curl,’ and executes it silently via ‘zsh.’