macOS Malware Abuses Fake Google Update for Persistence

A newly observed SHub macOS infostealer variant named “Reaper” uses typo-squatted lures and the applescript:// scheme to load malicious AppleScript in Script Editor, exfiltrate credentials and files (including wallets), and achieve persistence by impersonating GoogleUpdate via a LaunchAgent. The report details fingerprinting and anti-analysis checks, fileless execution via base64-decoded curl|zsh commands, wallet tampering (trojanized app.asar), C2 endpoints and domains, filesystem indicators, and recommended behavioral detections.