Active threat familymacOSCredential theft
Malware Intelligence

SHub Stealer

SHub Stealer is an infostealer family tracked in Dark Radar's stealer log data with 12,368 infection records. Latest record: October 2026. In 200 sampled logs, 100% contain saved passwords and 100% contain session cookies.

Activity map

Activity mapPackagingExfiltrationSHub StealerInfostealerData collection3 targetsLog archiveC2 server
Malicious payloadSHub Stealer · Infostealer

SHub Stealer is an infostealer family detected by Dark Radar in stealer logs.

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software
  • Screenshot

Credentials and application data

  • Saved passwords
  • Session cookies
  • Autofill
  • Saved cards
  • Keychain
Dark Radar infection records
12,368
Latest infection record
27 October 2026
Malware type
Infostealer
Logs reviewed
200
01

Overview

Ranks 33 of 52 families in Dark Radar data, with 12,368 infection records.

02

Technical profile

Malware typeInfostealer
Target operating systemmacOS
Primary purposeData theft
Threat categoryCredential theft
03

Targeted applications

3 applications2 categories
04

Data collection

Credentials

  • Browser passwords100%Dark Radar observation
  • Session cookies100%Dark Radar observation
  • Refreshing expired sessions—
  • Autofill100%Dark Radar observation
  • macOS Keychain86.5%Dark Radar observation
  • 2FA and password managers—

Financial

  • Saved cards10%Dark Radar observation
  • Desktop crypto wallets3.5%Dark Radar observation
  • Wallet extensions—
  • Clipboard address replacement—

System

  • File collection—
  • Screenshot6.5%Dark Radar observation
  • System inventory100%Dark Radar observation
05

File system

User folder (~)
File details are in Dark Radar IntelligenceOpen in Intelligence
06

How it works

  1. 1Data collection

    Dark Radar observation

    Data found in the latest 200 logs: password file 100%, cookies 100%, autofill 100%, cards 10%, wallets 3.5%.

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

07

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
08

Risk and impact

  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
09

Defense

  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
10

Learning center

How does this malware spread?
  • Infostealer families mostly spread through unlicensed software, fake updates, sponsored search ads and phishing emails.
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which macOS artifacts should be examined?
  • DMG files under ~/Downloads and the com.apple.quarantine attribute.
  • The user's Terminal history (~/.zsh_history).
  • Temporary ZIP archives under /tmp.
  • New plist files under ~/Library/LaunchAgents.
Which log records matter?
  • Unified log (log show)osascript processes and dialog boxes asking the user for a password.
  • TCC databaseFull Disk Access permission granted to Terminal or an unknown application.
  • Endpoint Security Framework (ESF)Processes accessing the Keychain file and browser profiles.
  • ~/.zshrc, LaunchAgentsLines and plist files added for persistence.
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
11

Sources

  • Dark Radar Infostealer Intelligence Library12,368 infection records, latest 200 logs reviewed. Updated: 30 October 2026
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans