SHub Stealer v2.0 is a sophisticated macOS infostealer known for its extensive targeting of cryptocurrency assets, utilizing a two-stage attack via a loader and an AppleScript payload. Active as of April 20, 2026, it employs a command-and-control (C2) server (http://terafolt.com) to deliver its malicious components and displays significant capabilities, including credential harvesting and backdooring of numerous cryptocurrency wallet applications.