Reaper macOS Infostealer Multi-Stage Attack Chain | MSSP Advisory

A new macOS infostealer called Reaper impersonates Apple, Microsoft, and Google to trick users into executing malicious code through a multi-stage attack chain. The malware targets browser data, password managers, and cryptocurrency wallets while establishing persistence on infected systems. SentinelOne researchers found this SHub variant moves away from standard ClickFix social engineering techniques toward more sophisticated delivery methods.

Mac users in your client environments face a credential harvesting threat that specifically targets password managers and browser stores where business credentials live. Your own Mac workstations used for client access could expose stored RMM credentials, PSA logins, and client VPN certificates if compromised. Every compromised Mac becomes a pathway into client networks through stored authentication tokens.

📬