Reaper macOS Malware Spreads via Fake Download Pages to Steal Crypto Wallet Data

A new macOS malware strain dubbed “Reaper” is being distributed through fake download pages for apps including WeChat and Miro, with the goal of stealing cryptocurrency wallet data, browser passwords, and sensitive documents. According to ChainCatcher, the report said the malware uses AppleScript URL triggers to open macOS’s built-in Script Editor and hides malicious code using ASCII art and spacing. After a user clicks the run button, a spoofed Apple security update pop-up prompts the victim to enter their computer password. The malware is reported to target desktop crypto applications including Ledger Live, Trezor Suite, and Exodus by modifying internal wallet code to intercept future transactions and redirect funds. The report said Reaper also steals saved credentials from Chrome, Firefox, and Edge, and extracts files such as .docx, .pdf, and .wallet from Desktop and Documents folders. It additionally installs a backdoor disguised as a Google software update directory to maintain persistence. Security experts advised users to verify download links, avoid entering passwords into unexpected pop-ups, and close any website that requests opening Script Editor.