Hackers Use Fake CleanMyMac Site to Deploy SHub Stealer and Hijack Crypto Wallets

Malwarebytes researchers found a fake CleanMyMac site (cleanmymacos.org) distributing SHub Stealer via a ClickFix terminal command; SHub harvests credentials, Keychain data, browser and Telegram data, and backdoors Electron-based crypto wallets (Exodus, Atomic Wallet, Ledger Wallet/Live, Trezor Suite) by replacing app.asar and re-signing apps to silently exfiltrate seed phrases to wallets-gate.io, uses geofencing to avoid Russian-language keyboards, maintains persistence via a LaunchAgent impersonating Google Keystone, and communicates with C2 at res2erch-sl0ut.com.