![\"Apple](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/05\/1779125837_852_0x0.jpg\")
<\/p>\n<\/p>\n
macOS infostealer spoofs Apple,Google and Microsoft in a single attack.<\/p>\n
NurPhoto via Getty Images<\/p>\n
Just because you use macOS does not mean you are off cybercriminals\u2019 radar. A clever new variant of a dangerous password stealer changes disguises at every stage of the infection chain. Security researchers warn it uses a payload hosted on a typo-squatted Microsoft domain, arrives disguised as an Apple security update, and hides inside a spoofed Google Software Update directory to maintain access to infected Macs. Here\u2019s what you need to know about the latest SHub Reaper multi-stage attack chain.<\/p>\n
ForbesSeniors Targeted\u2014FBI Issues Cyber Attack Advice For The Over 60sBy Davey Winder<\/a>The Latest SHub Reaper macOS Password Stealer Dissected<\/p>\n While Microsoft is stealing the security limelight for all the wrong reasons right now, with an actively exploited Exchange Server zero-day<\/a> confirmed and an angry Windows hacker<\/a> dropping more exploits at a rate of knots, macOS users should not be complacent.<\/p>\n While there are fewer active security threats facing users who have adopted an Apple ecosystem rather than a Microsoft one, that by no means implies that there are none. From the Atomic macOS Stealer<\/a> replete with an embedded backdoor, to the Infiniti Stealer targeting passwords, bringing the ClickFix threat to the Mac. Now you can add another macOS \u201cstealer\u201d to the mix in the shape of SHub Reaper, traditionally also using the ClickFix commands to terminal<\/a> technique, but, according to a May 18 analysis from SentinelOne research engineer Phil Stokes, this new variant \u201cuses a delivery mechanism that bypasses Terminal entirely and sidesteps Apple\u2019s Tahoe 26.4 mitigation for those attack flows.\u201d<\/p>\n Reaper uses fake WeChat and Miro installers as lures, Stokes confirmed, \u201cbut what stands out is the way the infection chain shifts its disguise at each stage.\u201d <\/p>\n This latest Reaper malware build also demonstrates that the criminal operators behind the SHub infostealer threat are \u201cextending their malware beyond straightforward credential and wallet theft,\u201d Stokes warned in the detailed and highly technical report<\/a>, \u201cAlongside an AMOS-style Filegrabber and chunked uploads\u201d Stokes said, \u201cthe variant also installs a persistent backdoor, giving the operators more ways to steal data or pivot to other malicious installs after the initial compromise.\u201d<\/p>\n