Do fear the Reaper - stealer swipes macOS users' passwords, wallets, then backdoors them

"A new infostealer variant targets macOS users by spoofing Apple, Microsoft, and Google and then then gets to work searching for victims' password managers so it can steal all of their credentials and access cryptocurrency wallets such as MetaMask and Phantom. The updated SHub stealer variant is called Reaper, and it uses macOS Script Editor, pre-populated with the malicious payload to execute the malware."

"Unlike earlier SHub versions and similar macOS stealer campaigns that rely on ClickFix social engineering tactics to trick the user into pasting a ScriptEditor command into Apple's Terminal command-line interface, Reaper bypasses Terminal altogether and therefore defeats defenses Apple added to Tahoe 26.4. The attack starts with fake WeChat and Miro installer websites, hosted on a domain designed to instill trust in users by typo-squatting a Microsoft URL: mlcrosoft[.]co[.]com."

"When a user visits these pages, hidden JavaScript collects a ton of information about their system and browser, including IP address, location, WebGL fingerprinting data, and indicators of virtual machines or VPNs. The attack stops if the victim is located in Russia. Assuming that the machine is located elsewhere and the user clicks on the fake tool installer, they open Apple's Script Editor app via a sneaky link that's heavily padded with ASCII art and fake terms to push the malicious command far below the visible portion of the window when it loads."

"When the victim clicks "Run" in Script Editor, the hidden command executes the malicious AppleScript and displays a popup message purporting to be a security update for Apple's XProtectRemediator tool. Instead of updating the security tool, however, it calls a curl command to silently download the shell script and it asks the "

Reaper targets macOS users by spoofing Apple, Microsoft, and Google and then searching for password managers to steal stored credentials. It also targets cryptocurrency wallets such as MetaMask and Phantom. The malware is delivered through fake WeChat and Miro installer websites hosted on a typo-squatted Microsoft domain. Hidden JavaScript collects system and browser details including IP address, location, WebGL fingerprinting data, and indicators of virtual machines or VPNs, and it stops if the victim is located in Russia. The payload opens Apple Script Editor using a padded, deceptive link. When “Run” is clicked, a popup appears as a supposed XProtectRemediator security update, but the command silently downloads and executes a shell script.

Read at theregister