--- title: Unmasking SHub Stealer: A Deep Dive into a Sophisticated... description: A detailed reverse-engineering analysis of SHub Stealer, a macOS info-stealer distributed via a phishing page impersonating GitHub Desktop. The attack uses a... canonical: https://daily.dev/posts/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-d-82xajmlwf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Unmasking SHub Stealer: A Deep Dive into a Sophisticated macOS Info-Stealer Masquerading as GitHub Desktop | daily.dev og:description: A detailed reverse-engineering analysis of SHub Stealer, a macOS info-stealer distributed via a phishing page impersonating GitHub Desktop. The attack uses a... og:url: https://daily.dev/posts/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-d-82xajmlwf og:image: https://api.daily.dev/og/posts/82XAJMLwF.png og:image:alt: Unmasking SHub Stealer: A Deep Dive into a Sophisticated macOS Info-Stealer Masquerading as GitHub Desktop og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unmasking SHub Stealer: A Deep Dive into a Sophisticated macOS Info-Stealer Masquerading as GitHub Desktop **[Faun](https://daily.dev/sources/faun)** · 7 min read · 1 upvotes · 0 comments ## Summary A detailed reverse-engineering analysis of SHub Stealer, a macOS info-stealer distributed via a phishing page impersonating GitHub Desktop. The attack uses a multi-stage dropper: a Base64-obfuscated curl command pipes a gzip-compressed loader script into zsh, which then fetches and executes an AppleScript payload. The malware performs CIS geofencing (exits if Russian keyboard layout detected), collects system telemetry, steals credentials from 14 Chromium browsers, ~100 crypto wallet extensions, Firefox, 25 desktop wallets, Telegram sessions, macOS Keychains, and iCloud tokens. Most critically, it injects malicious app.asar files into Exodus, Atomic Wallet, Ledger Live, and Trezor Suite — persisting even after malware removal. A LaunchAgent disguised as Google Keystone provides persistent RCE every 60 seconds. Indicators of Compromise and remediation commands are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [New macOS stealer campaign uses Script Editor in ClickFix attack](https://daily.dev/posts/new-macos-stealer-campaign-uses-script-editor-in-clickfix-attack-khhsvonhe) · BleepingComputer · 0 upvotes · 0 comments - [Reverse Engineering the Six Stages of MacSync Stealer and RAT](https://daily.dev/posts/reverse-engineering-the-six-stages-of-macsync-stealer-and-rat-dlt3btljo) · Huntress Blog · 0 upvotes · 0 comments - [GitHub Impersonation Deploys Information Stealer](https://daily.dev/posts/github-impersonation-deploys-information-stealer-fm6cyj2u0) · Arctic Wolf · 0 upvotes · 0 comments - [New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper](https://daily.dev/posts/new-macsync-macos-stealer-uses-signed-app-to-bypass-apple-gatekeeper-xfgu6c0kb) · The Hacker News · 2 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#phishing](https://daily.dev/tags/phishing), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-d-82xajmlwf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Unmasking SHub Stealer: A Deep Dive into a Sophisticated macOS Info-Stealer Masquerading as GitHub Desktop","url":"https://daily.dev/posts/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-d-82xajmlwf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-d-82xajmlwf"},"datePublished":"2026-05-05T20:56:08.647Z","dateModified":"2026-05-05T20:56:36.025Z","description":"A detailed reverse-engineering analysis of SHub Stealer, a macOS info-stealer distributed via a phishing page impersonating GitHub Desktop. The attack uses a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b4b7714f6f047bee9130a571ac471c10?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b4b7714f6f047bee9130a571ac471c10?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Faun","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Faun","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/71243dc2fd54430491336f7f7d4d83b1","url":"https://daily.dev/sources/faun"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-d-82xajmlwf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,phishing,reverse-engineering","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Faun","item":"https://daily.dev/sources/faun"},{"@type":"ListItem","position":3,"name":"Unmasking SHub Stealer: A Deep Dive into a Sophisticated macOS Info-Stealer Masquerading as GitHub Desktop"}]} ```