Mac malware gatecrashes Telegram, raids crypto wallets while you're still logged in 🍎🔐

A macOS information-stealing malware can hijack Telegram Desktop sessions and compromise cryptocurrency wallets, according to blockchain security firm SlowMist. The malware harvests data from the macOS Keychain, Safari cookies, Apple Notes, Telegram Desktop and databases associated with more than a dozen cryptocurrency wallets, aggregating passwords and authenticated sessions before exfiltrating them.

After collecting the data, the malware copies users' authenticated Telegram Desktop session data, wallet databases and browser wallet extension data. SlowMist said attackers can then attempt to decrypt the stolen wallet databases offline using passwords harvested from the infected device, or replace legitimate Ledger and Trezor applications with fake versions designed to trick users into entering their recovery phrases. The security firm reproduced the attack chain in an isolated environment.

The malware targets software wallets including Exodus, Atomic, Electrum, Wasabi and Monero, as well as hardware wallet applications such as Ledger Live and Trezor Suite, according to SlowMist. It also searches for wallet data stored by full-node clients including Bitcoin Core ($BTC), Litecoin Core, Dash Core and Dogecoin Core.

Telegram's two-step verification does not prevent the attack because the malware reuses an authenticated local session instead of initiating a new login, according to SlowMist. In tests, researchers restored stolen Telegram Desktop session data on another Mac without entering a phone number, verification code or two-step verification password.

SlowMist urged users who suspect their devices have been compromised to immediately terminate existing Telegram sessions, establish a new trusted login and change both their Telegram two-step verification password and Telegram Desktop passcode. The firm also recommended generating a new recovery phrase on a clean device and transferring all assets to new addresses.