Fake BlueWallet macOS Stealer — AppleScript Dropper Delivers Infostealer with Clipboard Crypto-Address Hijack and Telegram C2

Fake BlueWallet macOS Stealer (TL-2026-0648), also tracked as Fake BlueWallet Stealer, is a high-severity malware campaign, first published 2026-06-01. It has no confirmed attribution, affects Apple macOS, maps to 20 MITRE ATT&CK techniques (T1005, T1059.002, T1059.004), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-0648

Threat ID
TL-2026-0648
Also known as
Fake BlueWallet Stealer, BlueWallet Installer.applescript stealer
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-01
Last reviewed
2026-06-01
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
cryptocurrency, financial, technology, individuals
Target regions
Global
Detection rules
9
Indicators of compromise
21

Malware and tooling in Fake BlueWallet macOS Stealer

Malware and tooling: Fake BlueWallet Stealer, Telegram Bot API (single bot token + chat id)

A fake site impersonating the legitimate BlueWallet Bitcoin wallet (update-bluewallet[.]com) social-engineers macOS users into opening a downloaded 'BlueWallet Installer.applescript' in Script Editor and pressing Run/⌘R, sidestepping Gatekeeper notarization and quarantine. A base64-encoded shell one-liner fetches a second-stage stealer (/tmp/.sysupd.sh) that harvests passwords, browser data, 19+ desktop and browser-extension crypto wallets, six password managers, 2FA apps, and SSH/AWS/GnuPG/Kube/Git credentials, while hijacking the clipboard to swap copied BTC/ETH/SOL addresses for attacker-controlled ones. Exfiltration and interactive control run over a single Telegram bot channel. BlueWallet itself is not compromised.

How Fake BlueWallet macOS Stealer works

Researchers at Malwarebytes (Stefan Dasic, 2026-06-01) documented an active macOS social-engineering campaign distributing a credential- and crypto-stealing payload under the guise of the legitimate open-source BlueWallet Bitcoin wallet. The genuine project lives at bluewallet.io; the attacker-controlled lookalike update-bluewallet[.]com mimics its branding and auto-downloads a malicious file on a two-second timer. Critically, the campaign does NOT compromise BlueWallet or its supply chain — it abuses brand trust to socially engineer victims.

Initial access and execution: Rather than shipping a notarized app (which Gatekeeper would scrutinize), the site delivers 'BlueWallet Installer.applescript' (SHA-256 216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61) and instructs the victim to open it in Apple's Script Editor and press the Run button (⌘R). Because the user manually executes the script inside a trusted developer tool, macOS notarization and the com.apple.quarantine attribute are never enforced against a packaged binary — a deliberate Gatekeeper-bypass-by-design. The AppleScript carries a base64-encoded shell one-liner that, once decoded at runtime, uses curl to pull a second stage from https://projects2026box[.]com/serve_site/confighelper_0adfeee8.sh.

Second stage: The downloaded shell script is written to the hidden path /tmp/.sysupd.sh and executed. It creates a randomly-named working directory under /tmp (seeded from /dev/urandom with umask 077 so artifacts are non-predictable and private to the user), decodes its runtime configuration with an internal '_xd' routine using the XOR key 'swckR9JCD2Uu', and establishes persistence via a property-list-backed LaunchAgent in ~/Library/LaunchAgents with a hidden support directory so it re-launches at login.

Collection: The stealer enumerates and exfiltrates a broad credential surface — system/login passwords and browser-stored data (cookies, saved passwords, autofill, history); 12+ desktop wallets (Electrum, Exodus, Atomic Wallet, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, BlueWallet, Trust Wallet, Zengo, Monero, Sparrow); 15 browser-extension wallets across Bitcoin (Xverse, Leather, UniSat, Alby, Wizz), Solana (Phantom, Solflare, Backpack, MagicEden), and EVM (MetaMask, OKX, Coinbase Wallet, Rabby, Zerion, Rainbow); six password managers (LastPass, 1Password, Dashlane, Bitwarden, Keeper, NordPass); three 2FA apps (Google Authenticator, Authy, Microsoft Authenticator); and developer/cloud credentials in ~/.ssh, ~/.aws, ~/.gnupg, ~/.kube, and ~/.gitconfig.

Clipboard crypto-address hijack (clipper): Beyond bulk theft, the malware continuously monitors the clipboard and, when it detects a cryptocurrency address being copied, silently substitutes an attacker-controlled address so funds sent by the victim are redirected. The hard-coded swap destinations recovered from the stage-2 sample are BTC bc1qrmj4ggshddhnxx3rxwvsu8pe9ut6cgx8mx364e, ETH 0x2B871703122064e45d77146a6D5203da3bD192FA, and SOL 8dtdRQePrKz97FszwMEa4QvptdAAcbAFs7kBojr5Mz3v.

C2 and RAT capability: Exfiltration and live operator control share a single Telegram bot channel (Telegram Bot API over api.telegram.org). The operator can issue interactive commands — /info, /exec, /clipboard, /download, /exfil, and /selfdestruct — turning the stealer into a lightweight remote-access tool that can run arbitrary commands, pull additional files, read the clipboard on demand, and wipe itself. Attribution is unestablished; the tooling, broad wallet targeting, clipper, and Telegram C2 are consistent with a financially-motivated commodity macOS stealer operation and distinct from prior tracked macOS ClickFix/AppleScript stealers (TL-2026-0336/0348/0396/0471).

MITRE ATT&CK techniques used in TL-2026-0648

Collection

T1005 Data from Local System; T1115 Clipboard Data

Execution

T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.002 User Execution: Malicious File

Command and Control

T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography

Defense Evasion

T1140 Deobfuscate/Decode Files or Information; T1564.001 Hide Artifacts: Hidden Files and Directories

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Persistence

T1543.001 Create or Modify System Process: Launch Agent

defense-impairment

T1553.001 Subvert Trust Controls: Gatekeeper Bypass

Impact

T1565.002 Data Manipulation: Transmitted Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Affected products and versions in Fake BlueWallet macOS Stealer

  • Apple — macOS
    Vulnerable versions: all supported versions (user-initiated AppleScript execution bypasses Gatekeeper notarization/quarantine)
    Fixed in: N/A — social-engineering campaign, not a patchable defect
  • BlueWallet — BlueWallet Bitcoin Wallet (impersonated, NOT compromised)
    Vulnerable versions: none — legitimate app and supply chain are unaffected; only the brand is abused
    Fixed in: use official bluewallet.io

Remediation for Fake BlueWallet macOS Stealer

Patches

  • Not a software vulnerability — no patch. Install BlueWallet only from the official bluewallet.io / vendor app stores

Immediate actions

  • Block update-bluewallet[.]com and projects2026box[.]com at DNS/proxy/firewall
  • Alert users that BlueWallet is only available from bluewallet.io and that a real wallet is never installed by running a .applescript in Script Editor
  • Hunt endpoints for /tmp/.sysupd.sh, hidden umask-077 working dirs under /tmp, and unexpected ~/Library/LaunchAgents plists
  • Add the BTC/ETH/SOL clipboard-swap addresses to blockchain monitoring and warn finance/crypto teams

Workarounds

  • On any infected host, remove the LaunchAgent persistence and hidden /tmp working dir, then assume full compromise: rotate browser/password-manager credentials, SSH/AWS/GnuPG/Kube keys, and move all crypto funds to new wallets generated on a clean device (seed phrases must be treated as exposed)

Longer-term hardening

  • Deploy EDR with osascript/AppleScript and curl-from-Script-Editor telemetry
  • Restrict or monitor Script Editor execution via MDM and application controls
  • User education: never open or Run downloaded .applescript files; verify wallet download domains

Weaknesses (CWE) in Fake BlueWallet macOS Stealer

CWE-494, CWE-506, CWE-829

Timeline of Fake BlueWallet macOS Stealer

  • Single Telegram bot channel documented as combined exfiltration + RAT C2 with operator commands /info, /exec, /clipboard, /download, /exfil, /selfdestruct.
  • Hard-coded clipboard-swap addresses extracted — BTC bc1qrmj4ggshddhnxx3rxwvsu8pe9ut6cgx8mx364e, ETH 0x2B871703122064e45d77146a6D5203da3bD192FA, SOL 8dtdRQePrKz97FszwMEa4QvptdAAcbAFs7kBojr5Mz3v.
  • Second stage /tmp/.sysupd.sh analyzed: umask-077 random /tmp working dir, XOR config key 'swckR9JCD2Uu', LaunchAgent persistence, and broad wallet/credential collection recovered.
  • Dropper 'BlueWallet Installer.applescript' (SHA-256 216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61) identified; runs a base64 one-liner that curls a stage-2 from projects2026box[.]com.
  • Malwarebytes (Stefan Dasic) publishes full technical analysis of the fake BlueWallet AppleScript dropper and second-stage stealer.
  • Fake BlueWallet site update-bluewallet[.]com observed actively distributing a macOS stealer to cryptocurrency users by impersonating the legitimate bluewallet.io project.

Sources cited for Fake BlueWallet macOS Stealer

Threats related to Fake BlueWallet macOS Stealer

Detection coverage for TL-2026-0648

As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0648 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats