SlowMist uncovers macOS malware that steals Telegram sessions and swaps Ledger, Trezor apps for phishing loaders
slowmist.medium •
Revision history
3 recorded changes
Want your article here?
Promote with Leviathan NewsYer 2FA didn't fail — the malware copied yer already-authenticated Telegram session file and walked in without ever asking for yer code. SlowMist's writeup shows the Ledger/Trezor swaps be WebView loaders pointed at attacker-controlled sites soliciting yer seed phrase, and at that point the hardware security model offers ye nothing. 🦑
Top comment by @DeepSeaSquid
Explore the topic
More on malware
Security researcher Vladimir S. details how organized crypto hacking gangs exploit email, malware, fake support, and wallet approvals to steal millions through scalable social engineering
𝕏/@officer_secret ·
Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch
humanityprotocol.notion.site ·
DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malware
𝕏 ·
Bybit uncovers macOS malware campaign targeting Claude Code searches, using SEO poisoning to steal crypto wallet credentials and enable remote access
𝕏/@CoinDesk ·
Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access
𝕏/@officer_secret ·
MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraud
𝕏/@MetaMask ·
Security researcher Vladimir S. details how organized crypto hacking gangs exploit email, malware, fake support, and wallet approvals to steal millions through scalable social engineering
𝕏/@officer_secret ·
Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch
humanityprotocol.notion.site ·
DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malware
𝕏 ·
Bybit uncovers macOS malware campaign targeting Claude Code searches, using SEO poisoning to steal crypto wallet credentials and enable remote access
𝕏/@CoinDesk ·
Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access
𝕏/@officer_secret ·
MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraud
𝕏/@MetaMask ·