{
  "Event": {
    "analysis": "1",
    "date": "2026-05-18",
    "extends_uuid": "",
    "info": "[Threat Intel] macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain",
    "protected": false,
    "publish_timestamp": "1780138983",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1780138982",
    "uuid": "9f05b1a5-3943-44f0-9c7a-e5523c92663d",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#75e21e",
        "local": false,
        "name": "misp-galaxy:producer=\"SentinelOne\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#3eb869",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Data Staging - T1074.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#838eb9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keychain - T1555.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#89bea3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"AppleScript - T1059.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Cloud Storage - T1567.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#15723e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#680082",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"MacOS\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779159624",
        "to_ids": false,
        "type": "link",
        "uuid": "74d72eb4-ddc1-441a-bd6d-9abb52e8b7ec",
        "value": "https://www.sentinelone.com/blog/shub-reaper-macos-stealer-spoofs-apple-google-and-microsoft-in-a-single-attack-chain/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779159624",
        "to_ids": false,
        "type": "text",
        "uuid": "c800794f-a659-44f9-b2b1-13a3daef2ff8",
        "value": "A new variant of SHub Stealer dubbed 'Reaper' targets macOS users through fake WeChat and Miro installers, employing sophisticated multi-stage delivery chains that spoof Apple, Google, and Microsoft services. The malware leverages the applescript:// URL scheme to bypass Terminal-based defenses, conducting extensive fingerprinting and anti-analysis checks before execution. Reaper harvests browser credentials, cryptocurrency wallets, developer configurations, iCloud data, and Telegram sessions. It includes an AMOS-style document theft module targeting files under 150MB with chunked uploads. The variant establishes persistence through a fake Google Software Update LaunchAgent and installs a backdoor for remote code execution. The infection specifically avoids CIS regions and employs extensive anti-analysis techniques including WebGL fingerprinting, VM detection, and DevTools interference."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1779159624",
        "to_ids": false,
        "type": "text",
        "uuid": "55deefb1-afce-432f-b1d2-1e6dc579140e",
        "value": "Name: macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain\nAuthor: AlienVault\nAdversary: \nTags: [\"credential harvesting\", \"cryptocurrency theft\", \"infostealer\", \"backdoor\", \"shub reaper\", \"atomic macos stealer\", \"social engineering\", \"shub stealer\", \"amos\", \"persistence mechanism\", \"macos\", \"typosquatting\"]\nTgtd countries: []\nMlwr families: [\"SHub Stealer\", \"SHub Reaper\", \"AMOS\", \"Atomic macOS Stealer\"]\nAttack_ids: [\"T1560.001\", \"T1539\", \"T1074.001\", \"T1036.005\", \"T1555.001\", \"T1204.002\", \"T1082\", \"T1059.002\", \"T1005\", \"T1555.003\", \"T1083\", \"T1566\", \"T1059.004\", \"T1027\", \"T1567.002\", \"T1543.001\", \"T1070.004\", \"T1071.001\", \"T1102.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "Primary C2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135101",
        "to_ids": true,
        "type": "domain",
        "uuid": "d5001f86-e7ed-440c-85cb-1f68cced4fdb",
        "value": "hebsbsbzjsjshduxbs.xyz",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Hardcoded Build Hash No sample in VT\r\nLast check:30/05/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780131006",
        "to_ids": true,
        "type": "md5",
        "uuid": "08d064a3-2d07-4626-a3b1-ee22f06b1df0",
        "value": "c917fcf8314228862571f80c9e4a871e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135123",
        "to_ids": true,
        "type": "url",
        "uuid": "8e4cbd45-fba3-4651-8353-9758b78ff809",
        "value": "http://hebsbsbzjsjshduxbs.xyz/api/bot/heartbeat",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135144",
        "to_ids": true,
        "type": "url",
        "uuid": "f0e89be2-3131-4423-ae0c-4e12ac55376c",
        "value": "http://hebsbsbzjsjshduxbs.xyz/api/debug/event",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135165",
        "to_ids": true,
        "type": "url",
        "uuid": "40ef28cd-4801-42f2-b993-e627284bf313",
        "value": "http://hebsbsbzjsjshduxbs.xyz/gate",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135186",
        "to_ids": true,
        "type": "url",
        "uuid": "f44a8d54-eae5-48f5-945f-4181a4ce3898",
        "value": "http://hebsbsbzjsjshduxbs.xyz/gate/chunk",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Fake Miro Lure Domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135207",
        "to_ids": true,
        "type": "domain",
        "uuid": "016f8a21-08c0-4f33-aaa9-46099fe5876a",
        "value": "mlroweb.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Fake WeChat Lure Domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135228",
        "to_ids": true,
        "type": "domain",
        "uuid": "366f6fa1-ae25-40b9-a09b-2c249d4e8a84",
        "value": "qq-0732gwh22.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Fake WeChat Lure Domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135249",
        "to_ids": true,
        "type": "url",
        "uuid": "2e08f170-d9a4-4267-a5be-a37a158f4161",
        "value": "http://mlcrosoft.co.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Fake WeChat Lure Domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135271",
        "to_ids": true,
        "type": "hostname",
        "uuid": "14dc0eec-1627-4d10-b81f-ccc933b2a4e2",
        "value": "mlcrosoft.co.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 Endpoint",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135292",
        "to_ids": true,
        "type": "url",
        "uuid": "51fafc2e-31c0-4a78-8208-cc9a1516b723",
        "value": "https://hebsbsbzjsjshduxbs.xyz/api/debug/event",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 Endpoint",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135313",
        "to_ids": true,
        "type": "url",
        "uuid": "d8ade471-6254-4e18-be2e-d0d5423d44c9",
        "value": "https://hebsbsbzjsjshduxbs.xyz/api/bot/heartbeat",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 Endpoint",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780135334",
        "to_ids": true,
        "type": "url",
        "uuid": "393466bb-acd7-46cb-8e72-e0e30707b520",
        "value": "https://hebsbsbzjsjshduxbs.xyz/gate",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}