SHub Reaper macOS Infostealer Impersonation Attack Chain | MSSP Advisory

SHub Reaper is a new macOS infostealer variant that impersonates Apple, Google, and Microsoft in a single attack chain to bypass recent Terminal-based protections by moving execution into Apple's Script Editor instead. The malware targets credential theft, cryptocurrency wallet compromise, and persistent access on Mac systems. This represents an evolution from previous SHub variants that relied on Terminal commands and ClickFix social engineering.

Mac endpoints in client environments face credential theft from malware that specifically adapts to Apple's latest security controls, putting both client data and your remote access credentials at risk. Your clients running Macs need immediate awareness since this attack chain exploits trusted brand names that users typically accept without question.

📬