Back Gbhackers

macOS Malware Abuses Fake Google Update for Persistence

Gbhackers •Mayura Kathir • May 19, 2026

A newly observed variant of the SHub macOS infostealer, dubbed “Reaper,” is expanding its capabilities with stealthier delivery, enhanced data theft, and a persistence mechanism disguised as a legitimate Google software update. The Reaper variant continues SHub’s use of fake application installers, notably masquerading as WeChat and Miro downloads. However, its infection chain stands out […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New SHub Malware Variant 'Reaper' Targets macOS Users with Fake Google Update A new variant of the SHub macOS infostealer, named 'Reaper', has been detected using a fake Google Software Update to maintain persistence on infected systems. This malware targets macOS users by masquerading as legitimate software updates, specifically leveraging trusted brands like Google, WeChat, and Miro to deceive users. The Reaper variant enhances the original SHub's capabilities, including stealthier delivery methods and improved data theft mechanisms. Users may unknowingly install this malware, which can lead to significant data breaches. The infection chain is particularly concerning due to its ability to remain hidden and maintain access over time. Current reports indicate that this threat is actively being observed in the wild, affecting a growing number of macOS devices. 2 sources 65

Extracted Entities

macOS Malware Abuses Fake Google Update for Persistence

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)