SHub Stealer via macOS Terminal

Summary

The first of the three execution paths Microsoft separates, running from February 2026. The pasted Terminal command used curl to pull a shell script, which unpacked an embedded second stage and ran it in memory. That stage fingerprinted the machine — keyboard layout, hostname, OS version, external address — and reported an event back to the operator; a Russian or CIS keyboard layout made it stop instead, which the report reads as a deliberate exclusion. Otherwise an AppleScript stealer ran under osascript. It asked for the account password, checked it locally, then gathered browser credentials, Keychain items, notes, media, Telegram data, small documents and wallet files into a temporary folder marked SHub before archiving and uploading them. Ledger, Trezor and Exodus applications were overwritten with operator-supplied copies. A LaunchAgent posing as a Google updater left a heartbeat channel for later commands.

Overlap with other campaigns

We compared the 71 indicators in this record — covering 69 distinct registrable domains — against the 43 other published campaigns in this corpus.

• SHub and MacSync via GitHub lures

  2026-08-29

  1 of the 71 indicators in SHub Stealer via macOS Terminal also appear in this campaign.

• Odyssey Stealer's shared codebase

  2026-08-07

  No indicator is shared, but the two records use the same registrable domains.

  Shared registrable domain (1)

  • us[.]comdomain, shown defanged for safety: us dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Terminal paste (macOS) (T1059.004), which 8 of the 44 published campaigns in this corpus also record (18%).

Indicators

71 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.