Fake BlueWallet macOS Stealer — AppleScript Dropper Delivers Infostealer with Clipboard Crypto-Address Hijack and Telegram C2 — Threadlinqs Intelligence
As of 2026-06-01, Fake BlueWallet macOS Stealer — AppleScript Dropper Delivers Infostealer with Clipboard Crypto-Address Hijack and Telegram C2 is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0648 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A fake site impersonating the legitimate BlueWallet Bitcoin wallet (update-bluewallet[.]com) social-engineers macOS users into opening a downloaded 'BlueWallet Installer.applescript' in Script Editor
Researchers at Malwarebytes (Stefan Dasic, 2026-06-01) documented an active macOS social-engineering campaign distributing a credential- and crypto-stealing payload under the guise of the legitimate open-source BlueWallet Bitcoin wallet. The genuine project lives at bluewallet.io; the attacker-controlled lookalike update-bluewallet[.]com mimics its branding and auto-downloads a malicious file on a two-second timer. Critically, the campaign does NOT compromise BlueWallet or its supply chain — it abuses brand trust to socially engineer victims.
Initial access and execution: Rather than shipping a notarized app (which Gatekeeper would scrutinize), the site delivers 'BlueWallet Installer.applescript' (SHA-256 216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61) and instructs the victim to open it in Apple's Script Editor and press the Run button (⌘R). Because the user manually executes the script inside a trusted developer tool, macOS notarization and the com.apple.quarantine attribute are never enforced against a packaged binary — a deliberate Gatekeeper-bypass-by-design. The AppleScript carries a base64-encoded shell one-liner that, once decoded at runtime, uses curl to pull a second stage from https://projects2026box[.]com/serve_site/confighelper_0adfeee8.sh.
Second stage: The downloaded shell script is written to the hidden path /tmp/.sysupd.sh and executed. It creates a randomly-named working directory under /tmp (seeded from /dev/urandom with umask 077 so artifacts are non-predictable and private to the user), decodes its runtime configuration with an internal '_xd' routine using the XOR key 'swckR9JCD2Uu', and establishes persistence via a property-list-backed LaunchAgent in ~/Library/LaunchAgents with a hidden support directory so it re-launches at login.
Collection: The stealer enumerates and exfiltrates a broad credential surface — system/login passwords and browser-stored data (cookies, saved passwords, autofill, history); 12+ desktop wallets (Electrum, Exodus, Atomic Wallet, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, BlueWallet, Trust Wallet, Zengo, Monero, Sparrow); 15 browser-extension wallets across Bitcoin (Xverse, Leather, UniSat, Alby, Wizz), Solana (Phantom, Solflare, Backpack, MagicEden), and EVM (MetaMask, OKX, Coinbase Wallet, Rabby, Zerion, Rainbow); six password managers (LastPass, 1Password, Dashlane, Bitwarden, Keeper, NordPass); three 2FA apps (Google Authenticator, Authy, Microsoft Authenticator); and developer/cloud credentials in ~/.ssh, ~/.aws, ~/.gnupg, ~/.kube, and ~/.gitconfig.
Clipboard crypto-address hijack (clipper): Beyond bulk theft, the malware continuously monitors the clipboard and, when it detects a cryptocurrency address being copied, silently substitutes an attacker-controlled address so funds sent by the victim are redirected. The hard-coded swap destinations recovered from the stage-2 sample are BTC bc1qrmj4ggshddhnxx3rxwvsu8pe9ut6cgx8mx364e, ETH 0x2B871703122064e45d77146a6D5203da3bD192FA, and SOL 8dtdRQePrKz97FszwMEa4QvptdAAcbAFs7kBojr5Mz3v.
C2 and RAT capability: Exfiltration and live operator control share a single Telegram bot channel (Telegram Bot API over api.telegram.org). The operator can issue interactive commands — /info, /exec, /clipboard, /download, /exfil, and /selfdestruct — turning the stealer into a lightweight remote-access tool that can run arbitrary commands, pull additional files, read the clipboard on demand, and wipe itself. Attribution is unestablished; the tooling, broad wallet targeting, clipper, and Telegram C2 are consistent with a financially-motivated commodity macOS stealer operation and distinct from prior tracked macOS ClickFix/AppleScript stealers (TL-2026-0336/0348/0396/0471).
Weaknesses (CWE)
CWE-494, CWE-506, CWE-829
Target sectors: cryptocurrency, financial, technology, individuals
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1566, T1204.002, T1059.002, T1059.004, T1543.001, T1553.001, T1140, T1564.001, T1555