en
SHubSHub ReaperSHub Stealer (also known as SHub and SHub Reaper) is an information-stealing malware family. SHub Stealer targets browser credentials, cryptocurrency wallets, Telegram session tokens, macOS Keychain entries, iCloud session data, Developer configuration files and Notes and On-screen prompted login credentials (osascript dialog). As of 23/10/2026, CyStack's research records 1 variant, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
SHub Stealer is a macOS-targeted info-stealer first publicly
documented in March 2026 after a fake CleanMyMac landing-page
campaign delivered the payload to crypto holders. A follow-on
variant was analysed publicly under the build tag Reaper in
May 2026; the family also gets broad public coverage.
The payload is a Mach-O binary that runs an AppleScript helper
to harvest browser data, cryptocurrency wallets,
developer-related configuration files, macOS Keychain data,
iCloud session data, and Telegram session files. Collected
data is bundled into a ZIP archive and POSTed to a hardcoded
gate (e.g. res2erch-sl0ut[.]com/gate) along with a hardcoded
API key identifying the malware build. Per-victim Build Tag
campaign labels and a 32-character build hash support
affiliate-level tracking. Observed build tags include
Reaper, PAds, and Crypto_Byte.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
daef8ee... | 1 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Build Tag: <value>External IP: <value> Username: <value>Password: <value> Hostname: <value>OS Version: <value>Is CIS: <value>Software: System Software Overview: System Version: <value> Kernel Version: <value> Boot Volume: <value> Boot Mode: <value> Computer Name: <value> User Name: <value> Secure Virtual Memory: <value> System Integrity Protection: <value> Time since boot: <value> Hardware: Hardware Overview: Model Name: <value> Model Identifier: <value> Processor Name: <value> Processor Speed: <value> Number of Processors: <value> Total Number of Cores: <value> L2 Cache (per Core): <value> L3 Cache: <value> Memory: <value> Boot ROM Version: <value> Apple ROM Info: <value>Board-ID : <value> SMC Version (system): <value> Serial Number (system): <value> Hardware UUID: <value> Graphics/Displays: Display: Type: <value> Bus: <value> Slot: <value> PCIe Lane Width: <value> VRAM (Total): <value> Vendor: <value> Device ID: <value> Revision ID: <value> Kernel Extension Info: <value> Displays: Display: Resolution: <value> UI Looks like: <value> Framebuffer Depth: <value> Main Display: <value> Mirror: <value> Online: <value>…
