The campaign uses Script Editor instead of Terminal to run hidden AppleScript, then steals wallet data, browser credentials and documents while posing as Apple security updates.
Reaper, a new strain of Mac malware, is spreading through fake download pages for apps including WeChat and Miro and is designed to steal crypto wallet data and saved browser passwords. The campaign replaces an older Terminal-based social-engineering method with Script Editor, a preinstalled macOS app, using an applescript:// link to open hidden malicious code. Attackers conceal the code with ASCII art and whitespace, so users who click the play button in Script Editor can unknowingly execute the payload. The operation also uses typosquatted domains to appear legitimate. Security researchers found infrastructure on fake Microsoft lookalike domains including mlcrosoft[.]co[.]com. After execution, victims see a fraudulent Apple security update prompt that asks for their computer password. Reaper then checks the keyboard layout and stops if the system is configured for Russian. Otherwise, it deploys a theft module modeled on Atomic macOS Stealer, or AMOS (malware that steals data from Macs). The malware targets desktop crypto wallet apps including Ledger Live, Trezor Suite and Exodus, and can alter wallet code to intercept future transactions and redirect funds. It also collects saved credentials from Chrome, Firefox and Edge, along with data from extensions such as 1Password and MetaMask. Documents with .docx, .pdf, .xlsx, .wallet and .keys extensions from Desktop and Documents folders are compressed into 70MB ZIP chunks and sent to an external command-and-control server (system used to remotely manage malware). For persistence, Reaper installs a backdoor disguised as a Google Software Update directory. Moonlock said Reaper is the third campaign in about two months to use this automated AppleScript technique. Microsoft’s Defender Security Research Team also documented related campaigns that used fake macOS troubleshooting guides on Medium, Craft and Squarespace to deliver AMOS, Macsync and SHub Stealer through the ClickFix approach, a tactic that tricks users into running malicious instructions themselves. Cryptopolitan previously reported that those campaigns deleted legitimate wallet apps and silently replaced them with malicious versions.