Mac users looking for CleanMyMac are being lured to a fake website that delivers SHub Stealer, a macOS infostealer built to steal passwords, Apple Keychain data, browser sessions, Telegram files, Notes data, and cryptocurrency wallet information. Malwarebytes reported that the campaign used the fake domain cleanmymacos[.]org and a ClickFix-style prompt that told visitors to paste a command into Terminal themselves. That single action can turn a normal software search into a full Mac compromise, with stolen credentials, wallet exposure, and ongoing attacker access.
Quick Facts
- A fake CleanMyMac site tricks Mac users into running SHub Stealer through Terminal.
- SHub Stealer can steal Keychain data, browser credentials, Telegram sessions, Notes data, and crypto wallet information.
- Malwarebytes found that five wallet apps can be modified for continued theft after the initial infection.
- If the Terminal command was run, the Mac should be treated as compromised immediately.
How The Attack Starts
This fake CleanMyMac scam does not rely on a browser exploit or a silent drive-by download. The site tells the visitor to open Terminal and paste what looks like a normal install command for CleanMyMac. That detail matters because the victim starts the infection directly, which makes the process feel legitimate and gives macOS fewer chances to interrupt it before damage begins.
Malwarebytes reported that the command prints a fake MacPaw-related line, decodes a hidden URL, downloads a malicious shell script, and pipes it into zsh. Once that happens, the malware is already running under a user-initiated action. The attack stops looking like a suspicious download and starts looking like a technical setup step the user chose to run.
Why Terminal Is The Trap
This campaign uses a social-engineering method called ClickFix. Instead of exploiting a flaw in macOS, the attacker persuades the target to perform the step that starts the infection. That is what makes the fake CleanMyMac page dangerous. The site looks polished, the branding feels familiar, and the Terminal prompt makes the process seem advanced and credible.
Legitimate consumer Mac apps almost never require users to paste a Terminal command from a website just to install the software. That simple rule blocks a large share of fake software attacks on macOS.
Two details make this scam more convincing:
- The fake domain imitates CleanMyMac branding and product presentation.
- The command hides the real download source with base64-encoded content before execution.
A polished fake page lowers suspicion. A Terminal prompt makes the process feel technical. That combination still works because it turns trust and curiosity into manual execution.
What SHub Stealer Can Take
Once SHub Stealer gets past the first stage, it goes far beyond a simple password grab. Malwarebytes found that the malware displays a fake system password prompt, validates the entered password with dscl, and then uses that access to reach valuable local data across the Mac.
Reported targets include:
- Saved browser passwords
- Browser cookies
- Autofill records
- Apple Keychain material
- Safari data
- iCloud-related data
- Apple Notes databases
- Telegram session files
- Shell history
- .gitconfig data that may expose API keys or developer tokens
That theft scope is serious because many people keep personal accounts, financial access, browser secrets, and work credentials on the same Mac. One infection can expose all of them in one pass.
Why The Risk Is Serious
This fake CleanMyMac campaign is not limited to browser theft. SHub Stealer combines credential theft with broader macOS data collection and crypto wallet targeting. Malwarebytes reported that the malware targets 14 Chromium-based browsers plus Firefox, scans for 102 known crypto wallet browser extensions, and collects local storage from 23 desktop wallet apps.
One copied Terminal command can lead to account takeover, wallet exposure, and ongoing access, especially when the same Mac stores browser sessions, shell history, work credentials, and wallet software together.
Examples of exposed data include:
- Browser passwords, cookies, and autofill records
- Wallet app data from products such as Exodus, Ledger Live, and Trezor Suite
- Developer secrets exposed through shell history or config files
Malwarebytes also documented a geofencing check early in the attack chain. If a Russian-language keyboard is installed, the loader reports a cis_blocked event and exits. That behavior does not prove attribution, but it matches a pattern often seen in malware operations that avoid infecting nearby jurisdictions.
How Wallet Apps Get Hijacked
The most dangerous part of this fake CleanMyMac attack starts after the first round of theft. SHub Stealer does not just collect data and leave. Malwarebytes found that if certain Electron-based crypto wallet apps are installed, the malware silently replaces the app’s app.asar file with a modified version that continues stealing data in the background.
Malwarebytes confirmed five affected wallet apps:
- Exodus
- Atomic Wallet
- Ledger Wallet
- Ledger Live
- Trezor Suite
The malware kills the running app, overwrites the original logic file, strips the code signature, and re-signs the app so macOS still accepts it. That creates a persistent theft path inside software the victim may keep trusting and using.
Why Crypto Users Face More Risk
A stolen website password can usually be reset. A stolen seed phrase cannot. That difference makes this SHub Stealer campaign especially dangerous for crypto users.
Malwarebytes found that modified wallet apps sent passwords, mnemonics, or recovery phrases to the endpoint wallets-gate[.]io/api/injection. In Ledger-related apps, the malware disabled TLS certificate validation and displayed a fake recovery wizard. In Trezor Suite, the malware displayed a fake security update overlay and validated the seed phrase with the app’s own BIP39 library before exfiltration.
Reported behavior included:
- Exodus and Atomic Wallet stealing wallet credentials during unlock
- Ledger Live and Trezor Suite showing fake prompts designed to capture seed phrases
Once a seed phrase is stolen, the wallet is no longer trustworthy. The only safe response is to move funds to a new wallet created on a clean device.
How SHub Persists On Mac
Malwarebytes also documented persistence mechanisms that turn SHub Stealer from a one-time infostealer into an active backdoor. The malware installs a LaunchAgent at ~/Library/LaunchAgents/com.google.keystone.agent.plist and places a disguised GoogleUpdate component under ~/Library/Application Support/Google/.
That background task runs every 60 seconds and can execute commands returned by the attacker’s server. At that point, the problem is no longer limited to stolen passwords. The attacker may retain ongoing access to the Mac until those persistence files are found and removed.
Signs Your Mac May Be Hit
A Mac may be affected if any of the following happened:
- The user visited cleanmymacos[.]org or another fake CleanMyMac page
- A Terminal command was copied from a software website and executed
- A suspicious MacPaw-related message appeared during the install process
- The file com.google.keystone.agent.plist or a suspicious GoogleUpdate.app appeared in the paths reported by Malwarebytes
- A crypto wallet app started showing unusual prompts, fake updates, or seed phrase requests
Any one of those signs should be treated seriously. If the Terminal command was run, assume compromise first and verify second.
What To Do Right Now
If the fake CleanMyMac Terminal command was run, treat the Mac as compromised immediately. Do not assume the threat ended when the first script finished.
Take these steps in order:
- Disconnect the Mac from the internet to reduce ongoing attacker communication.
- Check for the fake LaunchAgent and suspicious GoogleUpdate.app folder described in the report and remove them if present.
- Change the macOS login password from a clean device.
- Change any passwords stored in browsers or Keychain from a clean device.
- Revoke exposed API keys, SSH keys, and access tokens that may have appeared in shell history or config files.
- Review Telegram, browser, email, and cloud accounts for suspicious sessions or logins.
- If any affected crypto wallet app was installed, assume wallet credentials or the seed phrase may be exposed.
- Move crypto funds to a new wallet created on a clean device.
A seed phrase cannot be safely changed after theft. That is why wallet migration matters more than an ordinary password reset in this case.
How To Avoid This Threat
The strongest defense is simple. Do not paste Terminal commands from software websites unless the source is verified and the command is fully understood. Most consumer Mac software installs through a normal app download, not through Terminal. Malwarebytes also warned that legitimate apps almost never require this kind of install flow.
These habits reduce risk fast:
- Download software only from the official developer site or the App Store.
- Type the vendor domain directly instead of trusting search results, ads, or lookalike domains.
- Treat any website that asks for Terminal-based installation of a consumer app as suspicious.
- Review the full command before running it, especially when it downloads and pipes remote content into a shell.
- Keep wallet apps, browsers, and local credentials off the same machine when possible.
FAQ
What Is SHub Stealer?
SHub Stealer is a macOS infostealer identified by Malwarebytes. It steals browser credentials, Apple Keychain data, Telegram sessions, Notes data, wallet information, and other local secrets. Malwarebytes also reported that it can backdoor specific crypto wallet apps for continued theft.
Is It Tied To MacPaw?
No. The fake site impersonates CleanMyMac and is not connected to the legitimate software or its developer, MacPaw.
Why Did macOS Not Stop It?
The victim manually ran the Terminal command. Once a user launches a malicious script directly, protections such as Gatekeeper, notarization checks, and XProtect have fewer chances to stop the attack chain before damage begins.
Which Wallets Were Hit?
Malwarebytes confirmed modifications affecting Exodus, Atomic Wallet, Ledger Wallet, Ledger Live, and Trezor Suite.
What Should Users Do Now?
Mac users should avoid Terminal-based install commands copied from websites, download software only from trusted sources, and treat any suspected SHub infection as a full compromise. Anyone who ran the fake command should reset credentials from a clean device, revoke exposed keys, and move crypto funds if seed phrase theft may have occurred.
Final Risk Summary
This fake CleanMyMac campaign shows how easily a polished scam can turn a routine software search into a serious macOS compromise. SHub Stealer does not stop at browser theft. Malwarebytes reported that it can reach Apple Keychain data, browser sessions, Telegram files, developer credentials, and cryptocurrency wallet information, then extend the damage through persistence and backdoored wallet apps. One copied command can become account takeover, financial loss, and long-term exposure across both personal and work systems.
The practical defense is simple. Download Mac software only from the official developer site or the App Store and never paste Terminal commands from a webpage unless the source is verified and fully understood. If the command was already run, treat the Mac as compromised, remove persistence files, reset passwords from a clean device, revoke exposed keys, and move crypto assets to a new wallet if seed phrase theft is possible. Fast action limits damage and helps restore trust in the system.
Where JENI Fits After Malware
A fake software page like this works by pushing the user outside normal macOS trust paths and into Terminal, where one copied command can trigger credential theft, wallet compromise, and persistence. After the urgent security steps are finished, the system may still need careful cleanup, subsystem repair, and removal of leftover residue that affects performance or stability.
JENI And Local Mac Cleanup
JENI is not a malware-removal substitute, and JENI does not replace password resets, wallet migration, or manual review of persistence files. JENI fits after those urgent steps by helping clean local clutter, clear leftover residue, and repair damaged macOS areas using local tools and repair actions.
- JENI can help clear caches, logs, temp files, browser residue, and other leftover data that may remain after a fake installer or malicious script touched the system.
- JENI can help rebuild Spotlight, Launch Services, audio, print, and other macOS subsystems if the infection or cleanup process left the Mac unstable or behaving oddly.
- JENI runs locally on Mac with no cloud activity, which matters when privacy, sensitive credentials, and trusted post-incident handling matter.
Recovery is rarely one step. A compromised Mac often needs password changes, wallet protection, persistence checks, and cleanup together. Used in the proper order, JENI supports the cleanup and repair side of recovery after the immediate security actions are finished. That helps restore a cleaner and more stable Mac without defaulting to a full reinstall unless the damage truly requires it.
