Live and recent posts from across the Fediverse tagged #shubstealer, aggregated by home.social.
2026-05-15 (Friday): #SHubStealer from fake installation page at 4wsperfiles[.]com.
C2 server: soopeqir2[.]com
Initial download URL from the copy/pasted script: hxxps[:]//soopeqir2[.]com/debug/loader.sh?build=dd894030fd54280e0bc95a80d2e261eb
SHub Stealer Build Tag: Warn4
So based on what I'm seeing, it's pronounced "S Hub" instead of "shub."
2026-05-08 (Friday): #macOS #ShubStealer infection
#pcap, malware files, and indicators available at https://malware-traffic-analysis.net/2026/05/08/index.html
Different file hashes and C2 server than the Shub Stealer I saw yesterday, but otherwise pretty much the same.
Microsoft researchers warn of a new #ClickFix campaign targeting macOS with fake guides on Medium and Craft to deploy AMOS and SHub Stealer via Terminal commands.
Read: https://hackread.com/fake-macos-troubleshooting-sites-steal-icloud-clickfix/
2026-05-07 (Thursday): #macOS #ShubStealer seen from fake GitHub App Installer page at m1solidfiles[.]com
Asks to copy/paste script into terminal window, which caused the following traffic:
"Debug" loader retrieved from:
- hxxps[:]//pwqepqwiriig[.]com/debug/loader.sh?build=10423f9c16ba853a4fd93afc5da0c44c
Script to install Shub Stealer:
- hxxps[:]//pwqepqwiriig[.]com/debug/payload.applescript?build=10423f9c16ba853a4fd93afc5da0c44c
HTTPS POST requests approximately once every minute for Shub Stealer C2 server:
- hxxps[:]//pwqepqwiriig[.]com/api/bot/heartbeat