macOS Malware Installs Fake Google Software Update LaunchAgent for Persistence

Cybersecuritynews •Tushar Subhra Dutta • May 19, 2026

macOS users are facing a new and sophisticated threat as a variant of the SHub infostealer malware, dubbed “Reaper,” has been observed deploying a fake Google Software Update LaunchAgent to maintain persistent access on infected machines. The malware stays hidden by borrowing the identity of brands that users already trust, making it exceptionally difficult to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New SHub Malware Variant 'Reaper' Targets macOS Users with Fake Google Update A new variant of the SHub macOS infostealer, named 'Reaper', has been detected using a fake Google Software Update to maintain persistence on infected systems. This malware targets macOS users by masquerading as legitimate software updates, specifically leveraging trusted brands like Google, WeChat, and Miro to deceive users. The Reaper variant enhances the original SHub's capabilities, including stealthier delivery methods and improved data theft mechanisms. Users may unknowingly install this malware, which can lead to significant data breaches. The infection chain is particularly concerning due to its ability to remain hidden and maintain access over time. Current reports indicate that this threat is actively being observed in the wild, affecting a growing number of macOS devices. 2 sources 65

Extracted Entities

macOS Malware Installs Fake Google Software Update LaunchAgent for Persistence

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)