macOS Malware Uses Fake Google Update to Establish Persistence

Key Takeaways

• A new macOS infostealer, dubbed “Reaper,” is actively targeting users through sophisticated social engineering.
• The malware leverages fake installers for popular applications like WeChat and Miro, delivered via typo-squatted domains mimicking legitimate services.
• Reaper establishes persistence by masquerading as a Google software update service and exfiltrates sensitive data, including cryptocurrency wallet files and browser credentials.
• The threat employs anti-analysis techniques and avoids execution in Commonwealth of Independent States (CIS) regions.

A new and highly deceptive variant of the SHub infostealer malware, identified as “Reaper,” is actively compromising macOS systems by impersonating trusted brands across its attack chain. This sophisticated threat was detailed in a recent report by SentinelOne, highlighting its ability to evade detection and establish persistent access.

SentinelOne researchers observed that Reaper strategically alters its disguise at each stage of the infection. The initial compromise often involves a user downloading a counterfeit installer for common applications such as WeChat or Miro. These malicious installers are frequently hosted on typo-squatted domains designed to mimic legitimate Microsoft infrastructure, adding a layer of authenticity to the deception.

Following a successful initial compromise, the malware executes its payload under the guise of an Apple security update. For persistence, it then embeds itself within a directory structure that imitates Google’s software update system. This multi-layered impersonation of globally recognized technology brands—Microsoft, Apple, and Google—within a single attack chain makes Reaper particularly challenging to identify without advanced security tools.

The SentinelOne analysis, shared with Cyber Security News (CSN), confirmed that the campaign leverages fake installers and employs AppleScript to bypass conventional detection mechanisms. This approach allows the malware to deliver its initial shell script without relying on typical social engineering tactics like ClickFix.

Fake Google Software Update for Persistence

Reaper distinguishes itself by bypassing Apple’s Terminal mitigation entirely, instead routing its execution through the macOS Script Editor. The malicious commands are dynamically constructed and padded with base64-encoded strings, effectively obscuring them from immediate view within the Script Editor window.

Before proceeding with its core malicious activities, Reaper performs a geolocation check. It queries the com.apple.HIToolbox.plist file to detect Russian-language input sources. If the system is identified as being located in a Commonwealth of Independent States (CIS) region, the malware communicates a cis_blocked event to its command and control (C2) server and terminates its operation, indicating a deliberate geo-blocking mechanism.

If the system is not in a CIS region, Reaper retrieves a second AppleScript containing its primary data extraction logic. This script is then executed in memory via osascript, preventing it from leaving direct traces on the local disk. This in-memory execution is a key anti-forensic technique.

To ensure long-term access, Reaper establishes persistence by creating a directory structure identical to Google’s legitimate Keystone update service. It places a base64-decoded bash script, named GoogleUpdate, within ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/. Concurrently, it registers a LaunchAgent using a property list named com.google.keystone.agent.plist. This configuration ensures the malicious script executes silently every 60 seconds in the background.

Each time the LaunchAgent triggers, the script sends system details to the attacker’s /api/bot/heartbeat endpoint. If the C2 server responds with a “code” payload, the script decodes it, writes it to /tmp/.c.sh, executes it with the current user’s privileges, and then promptly deletes it. This mechanism provides attackers with a persistent, stealthy, and trace-free remote execution channel on the compromised machine.

Data Theft and Anti-Analysis Measures

Reaper incorporates a “FileGrabber” routine designed to exfiltrate valuable data. It scans the Desktop and Documents folders for files likely to contain sensitive business or financial information. The malware specifically targets file extensions such as .docx, .wallet, .key, .json, and .rdp. It also collects images under 1MB and documents under 5MB, with a total collection cap of 100MB per exfiltration attempt. These files are initially staged in /tmp/shub_random/ before being segmented into 10MB chunks and uploaded to the attacker’s server via curl.

Beyond general document theft, Reaper actively targets cryptocurrency desktop applications, including Exodus, Atomic, Ledger Live, and Trezor Suite. It also harvests browser credentials and developer keystrokes, posing a significant threat to financial and intellectual property.

To impede security researchers, Reaper employs robust anti-analysis measures. It overrides console functions and runs a continuous debugger loop. If a researcher attempts to open browser developer tools (DevTools), the malicious page replaces its content with a Russian-language “access denied” message, further complicating forensic analysis.

What You Should Do

• Exercise Extreme Caution with Downloads: Never execute scripts from websites claiming a manual security update is required, especially if prompted to open Script Editor and run commands. Apple does not distribute updates this way.
• Verify Software Sources: Always download software exclusively from official developer websites or the trusted Mac App Store. Scrutinize URLs carefully for any typos or subtle alterations that indicate a malicious domain.
• Monitor for Unusual Activity: Defenders should actively look for unexpected AppleScript activity, unusual outbound network connections originating after Script Editor runs, and the creation of new LaunchAgents, particularly those mimicking legitimate software vendors like Google or Apple.
• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions capable of detecting and blocking sophisticated malware that employs living-off-the-land techniques and masquerades as legitimate system processes.
• Educate Users: Regularly train users on phishing, social engineering tactics, and the importance of verifying software sources and update procedures.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.