Fake Google Software Update Used by macOS Malware For Persistence

Information-stealing malware targeting macOS continues to evolve rapidly. Security researchers at SentinelOne recently discovered a new variant of the SHub Stealer family dubbed “Reaper.”

This malware uses a sophisticated infection chain to bypass standard security warnings, tricking victims with fake communication tool installers.

Once executed, it disguises itself as legitimate Apple and Google software to steal sensitive data and establish a persistent backdoor.

Fake Google Update Malware

Reaper initially lures victims through fake download pages for WeChat and Miro. These malicious websites are hosted on typo-squatted domains such as Microsoft [.]co[.]com and employ advanced anti-analysis techniques.

The sites gather telemetry on the visitor’s device, checking for virtual machines, VPNs, password managers, and cryptocurrency extensions.

If a researcher attempts to inspect the page code, it triggers a continuous debugger loop. It displays a fake Russian “Access Denied” message to halt analysis.

• The malicious code is pushed out of view using ASCII art padding.
• Executing the script displays a fake system update message for Apple’s XProtectRemediator tool.
• A background script checks whether the system uses Russian input sources and exits immediately if it detects a Commonwealth of Independent States (CIS) region.
• If the region check passes, it prompts the user for their login password to decrypt and harvest stored credentials.

Reaper targets a wide array of sensitive information. It steals data from major web browsers, developer configuration files, the macOS Keychain, and desktop cryptocurrency wallets.

The malware also includes a file-grabbing module similar to the Atomic macOS Stealer (AMOS). It searches the Desktop and Documents folders for business files, archiving them into 70MB chunks for remote upload.

Finally, Reaper attempts to hijack crypto wallets such as Exodus and Ledger by replacing their core application files, enabling attackers to intercept future transactions.

Unlike many macOS infostealers that run once and delete themselves, the Reaper variant installs a persistent backdoor.

It creates a hidden directory structure that mimics a legitimate Google Software Update path. The malware places a hidden script inside this fake Google directory and registers it as a macOS LaunchAgent.

According to SentinelOne research, acting as a beacon to the attacker’s command-and-control (C2) server.

It allows threat actors to silently download and run additional malicious code with the current user’s privileges.

This provides a dangerous, ongoing remote code execution capability long after the initial infection.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.