macOS Shub Stealer Spreads via Fake Download Page

Summary

A macOS credential-stealing threat known as Shub Stealer is being distributed through a malicious download page that instructs users to copy and paste a command into Terminal. The infection chain relies on password-protected ZIP archives and redirects victims to attacker-controlled content hosted on cloud platforms. The accompanying report includes network captures and log data that document how the infection unfolds.

Investigation

The analysis reviewed a PCAP file, a log file, and the malicious script used to deploy the stealer. Researchers found that the script was served through a web page posing as a legitimate macOS download portal and required the victim to manually run a Terminal command. Network traffic was then inspected in Wireshark to identify the command sequence and track payload delivery.

Mitigation

Users should never copy and run commands from untrusted websites. Organizations should verify software sources, deploy endpoint protection capable of detecting known macOS threats, and enforce application allow-listing wherever possible. Execution of unsigned scripts should be restricted, and defenders should monitor for suspicious shell activity on macOS systems.

Response

Security teams should detect execution of the known Shub Stealer command line, block communication with the identified malicious domains and IP addresses, and isolate any affected macOS endpoints. Investigators should also collect the provided logs and PCAP evidence for forensic review and remove any malicious files left on the host.

"graph TB %% Class definitions classDef technique fill:#99ccff classDef data fill:#c2f0c2 classDef proxy fill:#ffcc99 %% Technique nodes tech_content_injection["Technique – T1659 Content Injection Description: Inject malicious links or scripts into legitimate cloud documents (e.g., Google Drive) to gain initial access."] class tech_content_injection technique tech_html_smuggling["Technique – T1027.006 HTML Smuggling Description: Hide malicious script inside an HTML file that is executed when the file is rendered by a browser."] class tech_html_smuggling technique tech_svg_smuggling["Technique – T1027.017 SVG Smuggling Description: Embed malicious payload in an SVG image that, when parsed, redirects to a further download."] class tech_svg_smuggling technique tech_malicious_link["Technique – T1204.001 Malicious Link Description: Victim clicks a crafted link that initiates download of malicious content."] class tech_malicious_link technique tech_copy_paste["Technique – T1204.004 Malicious Copy and Paste Description: Attacker provides a command that the victim copies and pastes into a terminal, executing malicious code."] class tech_copy_paste technique tech_script_proxy["Technique – T1216 System Script Proxy Execution Description: Use a legitimate system scripting environment to proxy execution of malicious code."] class tech_script_proxy technique tech_compression["Technique – T1027.015 Compression Description: Deliver payload inside a passwordu2011protected ZIP archive to evade detection."] class tech_compression technique tech_brute_force["Technique – T1110 Brute Force Description: Attempt many passwords to discover the archive password, possibly leveraging information from public pages."] class tech_brute_force technique tech_deobfuscate["Technique – T1140 Deobfuscate/Decode Files Description: Open the encrypted ZIP using the discovered password to extract the malicious payload."] class tech_deobfuscate technique tech_archive_data["Technique – T1560 Archive Collected Data Description: Reu2011package stolen files into an archive before exfiltration."] class tech_archive_data data tech_c2_web["Technique – T1071.001 Application Layer Protocol: Web Protocols Description: Communicate with the command and control server over HTTP/HTTPS."] class tech_c2_web technique tech_c2_ftp["Technique – T1071.002 Application Layer Protocol: File Transfer Protocols Description: Transfer additional files using FTPu2011like protocols for C2."] class tech_c2_ftp technique tech_proxy["Technique – T1090 Proxy Description: Relay C2 traffic through proxy servers to hide origin."] class tech_proxy proxy tech_internal_proxy["Technique – T1090.001 Internal Proxy Description: Use a proxy located within the victimu2019s internal network."] class tech_internal_proxy proxy tech_external_proxy["Technique – T1090.002 External Proxy Description: Use an external proxy service to forward C2 traffic."] class tech_external_proxy proxy tech_taint_shared["Technique – T1080 Taint Shared Content Description: The copyu2011paste action spreads malicious script content to other shared environments."] class tech_taint_shared technique tech_exploit_client["Technique – T1203 Exploitation for Client Execution Description: Script leverages a clientu2011side vulnerability to execute arbitrary code on the victim machine."] class tech_exploit_client technique %% Connections tech_content_injection –>|leads_to| tech_html_smuggling tech_html_smuggling –>|leads_to| tech_svg_smuggling tech_svg_smuggling –>|leads_to| tech_malicious_link tech_malicious_link –>|leads_to| tech_copy_paste tech_copy_paste –>|leads_to| tech_script_proxy tech_script_proxy –>|leads_to| tech_compression tech_compression –>|leads_to| tech_brute_force tech_brute_force –>|leads_to| tech_deobfuscate tech_deobfuscate –>|leads_to| tech_archive_data tech_archive_data –>|leads_to| tech_c2_web tech_c2_web –>|leads_to| tech_c2_ftp tech_c2_ftp –>|leads_to| tech_proxy tech_proxy –>|routes_to| tech_internal_proxy tech_proxy –>|routes_to| tech_external_proxy %% Branches from copyu2011paste step tech_copy_paste –>|causes| tech_taint_shared tech_copy_paste –>|causes| tech_exploit_client "

Attack Flow

Detections

Possible IP Lookup Domain Communications Attempted (via dns)

SOC Prime Team

12 May 2026

View

Possible Base64 Encoded Strings Manipulation [MacOS] (via cmdline)

SOC Prime Team

12 May 2026

View

Suspicious Curl Execution Attempt [MacOS] (via cmdline)

SOC Prime Team

12 May 2026

View

Detection of Script Execution from Download for macOS Page [Linux Process Creation]

SOC Prime AI Rules

12 May 2026

View

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands:
1. Recon: The attacker discovers a malicious “Download for macOS” page that hosts a PowerShell‑style payload targeting macOS users.
2. Copy‑Paste: The attacker copies the entire script text, which includes the comment line “Script copied and pasted into a terminal window” (this is a literal marker inserted by the malware author).
3. Execution: In a Linux terminal, the attacker runs:
```
bash -c "Script copied and pasted into a terminal window"
```
  This command forces Bash to attempt to execute a command whose name is the exact detection phrase, causing the phrase to appear verbatim in the CommandLine field of the audit log. Even if the command fails, the creation event is logged and matches the Sigma rule.
4. Result: A process_creation event with CommandLine = bash -c Script copied and pasted into a terminal window is generated, triggering the detection.

Regression Test Script: The following self‑contained Bash script reproduces the scenario on any Linux host with auditd enabled.

#!/usr/bin/env bash
#
# Regression test for Sigma rule: eee9618f-c935-450d-9d51-7072fbfca466
# Purpose: Emit a process‑creation event that contains the exact detection phrase.
#
set -euo pipefail

# Emit the detection‑triggering command line
echo "[*] Executing detection‑triggering command..."
bash -c "Script copied and pasted into a terminal window"

echo "[*] Test complete. Check your SIEM for the detection."

Cleanup Commands: Remove any temporary files or lingering processes (none created by the test, but for completeness):

# No artifacts created; ensure no stray bash processes remain
pkill -f "Script copied and pasted into a terminal window" || true
echo "[*] Cleanup complete."

Shub Stealer Infection Notice for macOS

Summary

Investigation

Mitigation

Response

Attack Flow

Detections

Possible IP Lookup Domain Communications Attempted (via dns)

Possible Base64 Encoded Strings Manipulation [MacOS] (via cmdline)

Suspicious Curl Execution Attempt [MacOS] (via cmdline)

Detection of Script Execution from Download for macOS Page [Linux Process Creation]

Simulation Execution