--- title: "Unmasking SHub Stealer: A Deep Dive into a Sophisticated macOS Info-Stealer Masquerading as GitHub Desktop" url: https://daily.dev/posts/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-d-82xajmlwf source_url: https://faun.pub/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-bb26347731dd type: article source: "Faun" published: 2026-05-05T20:56:08.647Z updated: 2026-05-05T20:56:36.025Z tags: ["cyber", "phishing", "reverse-engineering"] reading_time: 7 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unmasking SHub Stealer: A Deep Dive into a Sophisticated macOS Info-Stealer Masquerading as GitHub Desktop **[Faun](https://daily.dev/sources/faun)** · 7 min read · 1 upvotes · 0 comments ## Summary A detailed reverse-engineering analysis of SHub Stealer, a macOS info-stealer distributed via a phishing page impersonating GitHub Desktop. The attack uses a multi-stage dropper: a Base64-obfuscated curl command pipes a gzip-compressed loader script into zsh, which then fetches and executes an AppleScript payload. The malware performs CIS geofencing (exits if Russian keyboard layout detected), collects system telemetry, steals credentials from 14 Chromium browsers, ~100 crypto wallet extensions, Firefox, 25 desktop wallets, Telegram sessions, macOS Keychains, and iCloud tokens. Most critically, it injects malicious app.asar files into Exodus, Atomic Wallet, Ledger Live, and Trezor Suite — persisting even after malware removal. A LaunchAgent disguised as Google Keystone provides persistent RCE every 60 seconds. Indicators of Compromise and remediation commands are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#phishing](https://daily.dev/tags/phishing), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/unmasking-shub-stealer-a-deep-dive-into-a-sophisticated-macos-info-stealer-masquerading-as-github-d-82xajmlwf)