Product
high
advisory
SHub Reaper Stealer Backdoors macOS with Multi-Brand Spoofing
3 rules 4 TTPsThe SHub Reaper stealer combines credential theft, wallet hijacking, and document exfiltration with persistent backdoor access on macOS, distributed through fake WeChat and Miro installers while spoofing Apple, Google, and Microsoft to evade detection.
WeChat +3
macos
infostealer
backdoor
social-engineering
applescript
3r
4t
high
advisory
SHub macOS Infostealer Variant 'Reaper' Spoofing Apple Security Updates
3 rules 5 TTPs 3 IOCsA new variant of the 'SHub' macOS infostealer, dubbed Reaper, uses AppleScript to display a fake security update message and install a backdoor, ultimately stealing browser data, financial documents, and cryptocurrency wallet information while bypassing Terminal-based mitigations in macOS.
Chrome +19
macos
infostealer
shub reaper
malware
3r
5t
3i