Do fear the Reaper - stealer swipes macOS users' passwords, wallets, then backdoors them
2026-05-19T07:24:01Z•2f715f49fd38cec70d9b188348b5d7f0e5ee57f49131ffcdc2bede313f03fdda
Dirty-FragFragnesiaGitHubGrafanaLinux-kernelNGINXShai-HuludShinyHuntersTanStackbackdoorcache-poisoningcredential-theftcryptowalletdomain-spoofingexploitincident-responsemacOSmalwarenpmopen-sourcepatchingprivilege-escalationransomwarestealersupply-chain
What happened
A batch of The Register security stories highlights multiple active, high-impact threats: a new macOS stealer dubbed “Reaper” that steals passwords, crypto wallets and installs backdoors while spoofing trusted domains; widespread npm supply-chain attacks (Shai‑Hulud and copycats) that poisoned TanStack packages and impacted organizations including OpenAI; multiple Linux kernel privilege‑escalation flaws (Dirty Frag / Fragnesia and related bugs) with public exploit code; rapid probing and exploitation of the NGINX Rift flaw; and several supply‑chain and code‑repository incidents (Grafana GitHub
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- theregister_security
- Record identifier
- 2f715f49fd38cec70d9b188348b5d7f0e5ee57f49131ffcdc2bede313f03fdda
- Enrichment time
- 2026-05-19T07:24:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.