SHub Reaper is a macOS infostealer campaign that bypasses Apple’s March 2026 Terminal restriction by delivering malicious code through the AppleScript URL scheme, requiring only a single user click on a social-engineered lure. The malware targets employees on macOS systems, harvesting browser credentials, password manager vaults, iCloud and Telegram sessions, and cryptocurrency wallet seed phrases. The highest business risk is wallet binary replacement, which enables persistent financial theft and backdoor access well beyond the initial infection event.