MacOS Malware Hijacks Telegram Sessions, Targets Crypto Wallets
Vexoda Newsroom
A macOS malware has been discovered that hijacks Telegram sessions and targets cryptocurrency wallets. SlowMist details the attack methods used by the malware.
Recently, a new strain of macOS malware was identified by blockchain security firm SlowMist, which can infiltrate users' devices to steal credentials and compromise their crypto assets through Telegram Desktop sessions.
The malware harvests data from various sources on infected Mac systems, including the Keychain, Safari cookies, Apple Notes, and wallet databases. By collecting passwords and authenticated session information, it allows attackers to decrypt stolen wallets offline or trick users into revealing recovery phrases via fake applications.
Notably, the attack chain does not rely on Telegram's two-step verification process as it reuses an existing local session instead of initiating a new login. This highlights the importance of maintaining vigilant security practices even with seemingly robust authentication measures in place.
In response to this threat, SlowMist advised users to immediately terminate active Telegram sessions and establish new trusted logins on clean devices. They also recommended changing both Telegram two-step verification passwords and desktop passcodes while generating fresh recovery phrases for added protection.
The implications of this malware are significant as it targets a wide range of popular crypto wallets such as Exodus, Atomic, Electrum, Wasabi, Monero, Ledger Live, Trezor Suite, and full-node clients like Bitcoin Core, Litecoin Core, Dash Core, and Dogecoin Core. This underscores the ongoing risks associated with managing digital assets on interconnected platforms.
Traders should remain vigilant against such threats by regularly updating software, enabling strong two-factor authentication wherever possible, and keeping their devices free from malware through rigorous security practices.
Source: Cointelegraph. Summarized and rewritten by the Vexoda Newsroom. This is market news, not financial advice.