[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIhF_p4tBA1knYzy0CUjVJqlj3PAg-eQayPfOxi3oZ8o":3},{"article":4,"iocs":39,"watch_terms":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":11,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"81cb075c-359f-4391-a6e2-06088c303ba8","Ongoing #macOS #malware campaign target users searching for Homebrew on Mac with malicious ads, t...","ongoing-macos-malware-campaign-target-users-searching-for-homebrew-on-mac-with-m","Ongoing #macOS #malware campaign target users searching for Homebrew on Mac with malicious ads, tricking them with fake install commands. The script fingerprints the device and deploys SHub Stealer to steal wallets & passwords. New C2 domains appear daily: https:\u002F\u002Ft.co\u002FxqHuXCuhMo https:\u002F\u002Ft.co\u002FNHVGyCqijn","An ongoing macOS malware campaign targets users searching for Homebrew by displaying malicious ads with fake installation commands. The attack script fingerprints devices and deploys SHub Stealer to harvest cryptocurrency wallets and passwords. Threat actors are rotating C2 domains daily to evade detection.","macOS malware campaign uses fake Homebrew ads to deploy SHub Stealer credential thief.",null,"https:\u002F\u002Fx.com\u002FUnit42_Intel\u002Fstatus\u002F2039135243030929579","2026-04-01T00:18:21+00:00","2026-04-01T01:00:08.247735+00:00",8,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":11,"name":19,"slug":20},"Malware","malware",[22,27,32,34],{"category":23},{"id":24,"icon":11,"name":25,"slug":26},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":28},{"id":29,"icon":11,"name":30,"slug":31},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":33},{"id":17,"icon":11,"name":19,"slug":20},{"category":35},{"id":36,"icon":11,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40],{"type":20,"value":41,"context":42},"SHub Stealer","Credential and wallet theft malware deployed via malicious Homebrew ads on macOS",[]]