Pulse Detail — Threat Intelligence

PULSE NAME

macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain

WHITE Tr1sa111 2026-05-19 Modified: 2026-05-19

IOCs

LOW VOLUME

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

MALWARE FAMILIES

SHub Stealer SHub Reaper AMOS Atomic macOS Stealer

Indicators of Compromise (9)

All FileHash-MD5 URL domain

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	c917fcf8314228862571f80c9e4a871e	—	2026-05-19
URL	http://hebsbsbzjsjshduxbs.xyz/api/bot/heartbeat	—	2026-05-19
URL	http://hebsbsbzjsjshduxbs.xyz/api/debug/event	—	2026-05-19
URL	http://hebsbsbzjsjshduxbs.xyz/gate	—	2026-05-19
URL	http://hebsbsbzjsjshduxbs.xyz/gate/chunk	—	2026-05-19
domain	hebsbsbzjsjshduxbs.xyz	—	2026-05-19
domain	mlroweb.com	—	2026-05-19
domain	qq-0732gwh22.com	—	2026-05-19
URL	http://mlcrosoft.co.com	—	2026-05-19

References (1)