Pirated Mac Apps Exploit Crypto Wallets with New Malware

Recently, Kaspersky Labs made an alarming discovery in the world of macOS users. They uncovered a previously unknown malware that infiltrates computers through pirated software. This malware specifically targets users’ Bitcoin and Exodus wallets, replacing them with infected versions. It seems that the hackers behind this operation are still in the process of developing the malware for an upcoming campaign.

In December, researchers came across a new group of trojan proxies. These hackers were “cracking” legitimate apps and distributing them through unauthorized sources. They understood that individuals seeking cracked software would be more susceptible to downloading installers from questionable websites and disabling their security measures. Exploiting this vulnerability, cybercriminals were able to trick users into installing malware on their machines.

The malware focuses on macOS versions 13.6 and later. It gains access to users’ computer security passwords by luring them into an activator box. Additionally, it targets the private keys to crypto wallets when users attempt to open compromised wallets. Researchers diligently observed the malware’s development as they traced its activities. Though the method itself is basic, the malware implementation is remarkably cunning. The final outcome was a backdoor that granted the hackers administrator privileges and replaced the legitimate crypto wallet applications with infected versions. These infected versions would steal secret recovery phrases the moment the wallet was unlocked.

To protect against this malicious malware campaign, it is crucial to employ caution while browsing the internet. It is wise to stick to trusted websites, regularly update one’s operating system, and utilize a reliable security solution. Moreover, it is essential to be aware of hackers disguising malware as legitimate wallets or presenting them on fake websites. This tactic has become so widespread that the FBI even issued a warning about it.

In a separate incident, the Lazarus Group, a North Korean hacker collective, targeted macOS users within the decentralized finance community. Their malware circulated in Discord groups, posing a significant threat to unsuspecting victims. This emphasizes the need for heightened cybersecurity measures and constant vigilance to protect oneself from cyberattacks.