Fake BlueWallet macOS Stealer — AppleScript Dropper Delivers Infostealer with Clipboard Crypto-Address Hijack and Telegram C2

Key facts for Fake BlueWallet Stealer

Detection coverage for Fake BlueWallet Stealer

As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0648 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake BlueWallet Stage-2 — /tmp/.sysupd.sh Exec, Hidden umask-077 Workdir & Credential-Store Sweep (Post-Exploitation)

Detects TL-2026-0648 second-stage activity: execution of the hidden /tmp/.sysupd.sh stealer, creation of a /dev/urandom-seeded umask-077 hidden working directory under /tmp, and rapid read access across the targeted ~/.ssh ~/.aws ~/.gnupg ~/.kube ~/.gitconfig developer/cloud credential stores. Surfaces the broad credential-collection burst that follows the dropper.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1564.001, T1140, T1552.001, T1555.003
• Data sources: osquery, macos_unified_log, edr
• Severity: critical
• Confidence: high

Splunk SPL

index=macos sourcetype="osquery:results" (name=process_events OR name=file_events)
| rename columns.cmdline as cmdline columns.path as path columns.target_path as target_path columns.action as action
| eval ind=case(match(cmdline,"/tmp/\.sysupd\.sh"),"stage2_exec", match(target_path,"^/Users/[^/]+/\.(ssh|aws|gnupg|kube|gitconfig)"),"cred_store_access", match(target_path,"^/tmp/\.[0-9a-f]{8,}"),"hidden_workdir")
| where isnotnull(ind)
| stats dc(ind) as indicator_types values(ind) as indicators values(target_path) as paths values(cmdline) as cmdlines min(_time) as firstTime max(_time) as lastTime by host
| where indicator_types>=2
| eval phase="post-exploitation", threat="TL-2026-0648 Fake BlueWallet Stealer"
| convert ctime(firstTime) ctime(lastTime)
| table host indicators paths cmdlines indicator_types firstTime lastTime phase threat

Microsoft KQL

let creds = dynamic([".ssh", ".aws", ".gnupg", ".kube", ".gitconfig"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where (FolderPath has "/tmp/.sysupd.sh")
    or (FolderPath matches regex @"/Users/[^/]+/\.(ssh|aws|gnupg|kube|gitconfig)")
    or (FolderPath matches regex @"^/private/tmp/\.[0-9a-f]{8,}" or FolderPath matches regex @"^/tmp/\.[0-9a-f]{8,}")
| extend Indicator = case(
    FolderPath has "/tmp/.sysupd.sh", "stage2",
    FolderPath matches regex @"\.(ssh|aws|gnupg|kube|gitconfig)", "cred_store",
    "hidden_workdir")
| summarize IndicatorTypes = dcount(Indicator), Indicators = make_set(Indicator), Paths = make_set(FolderPath), Start = min(Timestamp), End = max(Timestamp) by DeviceName, InitiatingProcessFileName
| where IndicatorTypes >= 2

Sigma

title: Fake BlueWallet Stage-2 — /tmp/.sysupd.sh Exec and Credential-Store Sweep
id: 1b4e2d3f-8c25-4e0b-ac32-7f1b3e6d2f02
status: experimental
description: Detects the TL-2026-0648 second-stage stealer — execution of hidden /tmp/.sysupd.sh, a umask-077 /dev/urandom-named hidden /tmp working directory, and rapid access to ~/.ssh ~/.aws ~/.gnupg ~/.kube ~/.gitconfig credential stores.
references:
    - https://www.malwarebytes.com/blog/threat-intel/2026/06/fake-bluewallet-steals-passwords-accounts-and-crypto-from-macs
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/01
tags:
    - attack.execution
    - attack.defense_evasion
    - attack.credential_access
    - attack.t1059.004
    - attack.t1564.001
    - attack.t1552.001
    - attack.t1555.003
logsource:
    product: macos
    category: process_creation
detection:
    selection_stage2:
        CommandLine|contains: '/tmp/.sysupd.sh'
    selection_credsweep:
        CommandLine|contains:
            - '/.ssh'
            - '/.aws'
            - '/.gnupg'
            - '/.kube'
            - '/.gitconfig'
    condition: selection_stage2 or selection_credsweep
falsepositives:
    - Backup or sync tooling reading multiple dotfile credential stores (correlate with /tmp/.sysupd.sh execution to confirm)
level: high

Known false positives:

• Backup/sync agents (e.g. rsync, cloud backup) touching multiple credential dotfiles in succession — correlate with /tmp/.sysupd.sh execution
• Developer tooling enumerating ~/.aws or ~/.kube profiles

Tuning notes: Require >=2 distinct indicator types to reduce noise from single legitimate credential reads. Tighten the hidden-workdir regex to your /tmp vs /private/tmp normalization. Add ~/Library/Application Support browser wallet paths to extend collection coverage.

• 🔒 Fake BlueWallet AppleScript Dropper — Script Editor/osascript -> curl Stage-1 Fetch (Exploitation) · unlock with TL Creds
• 🔒 Fake BlueWallet Persistence & Hidden Stage-2 — com.apple.sysupd LaunchAgent and [indicator] (Post-Exploitation) · unlock with TL Creds
• 🔒 Fake BlueWallet Telegram C2 & Clipper — Non-Browser [indicator] Beacon and Swap-Address Clipboard (C2) · unlock with TL Creds
• 🔒 Fake BlueWallet AppleScript Dropper — osascript/Script Editor -> curl Stage-1 (Sigma, Exploitation) · unlock with TL Creds
• 🔒 Fake BlueWallet Persistence & Credential Sweep — LaunchAgent + XOR Stage-2 (Sigma, Post-Exploitation) · unlock with TL Creds
• 🔒 Fake BlueWallet Clipper & Telegram C2 — Swap Addresses + [indicator] (Sigma, C2/Lateral Movement) · unlock with TL Creds
• 🔒 Fake BlueWallet AppleScript Dropper — Script Editor/osascript Spawning curl to Stage-1 Host (Exploitation) · unlock with TL Creds
• 🔒 Fake BlueWallet Clipper & Telegram C2 — Clipboard Crypto-Swap Addresses and [indicator] Beacon (C2) · unlock with TL Creds

Indicators of compromise for Fake BlueWallet Stealer

As of 2026-06-01, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-0648.

Sample indicators (3 of 21)

• Domain: update-bluewallet[.]com
• File hash: 216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61
• Domain: projects2026box[.]com

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

How Fake BlueWallet Stealer works

Exfiltration and interactive control run over a single Telegram bot channel. BlueWallet itself is not compromised.

Researchers at Malwarebytes (Stefan Dasic, 2026-06-01) documented an active macOS social-engineering campaign distributing a credential- and crypto-stealing payload under the guise of the legitimate open-source BlueWallet Bitcoin wallet. The genuine project lives at bluewallet.io; the attacker-controlled lookalike update-bluewallet[.]com mimics its branding and auto-downloads a malicious file on a two-second timer. Critically, the campaign does NOT compromise BlueWallet or its supply chain — it abuses brand trust to socially engineer victims.

Initial access and execution: Rather than shipping a notarized app (which Gatekeeper would scrutinize), the site delivers 'BlueWallet Installer.applescript' (SHA-256 216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61) and instructs the victim to open it in Apple's Script Editor and press the Run button (⌘R). Because the user manually executes the script inside a trusted developer tool, macOS notarization and the com.apple.quarantine attribute are never enforced against a packaged binary — a deliberate Gatekeeper-bypass-by-design. The AppleScript carries a base64-encoded shell one-liner that, once decoded at runtime, uses curl to pull a second stage from https://projects2026box[.]com/serve_site/confighelper_0adfeee8.sh.

Second stage: The downloaded shell script is written to the hidden path /tmp/.sysupd.sh and executed. It creates a randomly-named working directory under /tmp (seeded from /dev/urandom with umask 077 so artifacts are non-predictable and private to the user), decodes its runtime configuration with an internal '_xd' routine using the XOR key 'swckR9JCD2Uu', and establishes persistence via a property-list-backed LaunchAgent in ~/Library/LaunchAgents with a hidden support directory so it re-launches at login.

Collection: The stealer enumerates and exfiltrates a broad credential surface — system/login passwords and browser-stored data (cookies, saved passwords, autofill, history); 12+ desktop wallets (Electrum, Exodus, Atomic Wallet, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, BlueWallet, Trust Wallet, Zengo, Monero, Sparrow); 15 browser-extension wallets across Bitcoin (Xverse, Leather, UniSat, Alby, Wizz), Solana (Phantom, Solflare, Backpack, MagicEden), and EVM (MetaMask, OKX, Coinbase Wallet, Rabby, Zerion, Rainbow); six password managers (LastPass, 1Password, Dashlane, Bitwarden, Keeper, NordPass); three 2FA apps (Google Authenticator, Authy, Microsoft Authenticator); and developer/cloud credentials in ~/.ssh, ~/.aws, ~/.gnupg, ~/.kube, and ~/.gitconfig.

Clipboard crypto-address hijack (clipper): Beyond bulk theft, the malware continuously monitors the clipboard and, when it detects a cryptocurrency address being copied, silently substitutes an attacker-controlled address so funds sent by the victim are redirected. The hard-coded swap destinations recovered from the stage-2 sample are BTC bc1qrmj4ggshddhnxx3rxwvsu8pe9ut6cgx8mx364e, ETH 0x2B871703122064e45d77146a6D5203da3bD192FA, and SOL 8dtdRQePrKz97FszwMEa4QvptdAAcbAFs7kBojr5Mz3v.

C2 and RAT capability: Exfiltration and live operator control share a single Telegram bot channel (Telegram Bot API over api.telegram.org). The operator can issue interactive commands — /info, /exec, /clipboard, /download, /exfil, and /selfdestruct — turning the stealer into a lightweight remote-access tool that can run arbitrary commands, pull additional files, read the clipboard on demand, and wipe itself. Attribution is unestablished; the tooling, broad wallet targeting, clipper, and Telegram C2 are consistent with a financially-motivated commodity macOS stealer operation and distinct from prior tracked macOS ClickFix/AppleScript stealers (TL-2026-0336/0348/0396/0471).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1115 Clipboard Data

Execution

T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.002 User Execution: Malicious File

Command and Control

T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography

Defense Evasion

T1140 Deobfuscate/Decode Files or Information; T1564.001 Hide Artifacts: Hidden Files and Directories

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Persistence

T1543.001 Create or Modify System Process: Launch Agent

defense-impairment

T1553.001 Subvert Trust Controls: Gatekeeper Bypass

Impact

T1565.002 Data Manipulation: Transmitted Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Remediation for Fake BlueWallet Stealer

Patches

• Not a software vulnerability — no patch. Install BlueWallet only from the official bluewallet.io / vendor app stores

Immediate actions

• Block update-bluewallet[.]com and projects2026box[.]com at DNS/proxy/firewall
• Alert users that BlueWallet is only available from bluewallet.io and that a real wallet is never installed by running a .applescript in Script Editor
• Hunt endpoints for /tmp/.sysupd.sh, hidden umask-077 working dirs under /tmp, and unexpected ~/Library/LaunchAgents plists
• Add the BTC/ETH/SOL clipboard-swap addresses to blockchain monitoring and warn finance/crypto teams

Workarounds

• On any infected host, remove the LaunchAgent persistence and hidden /tmp working dir, then assume full compromise: rotate browser/password-manager credentials, SSH/AWS/GnuPG/Kube keys, and move all crypto funds to new wallets generated on a clean device (seed phrases must be treated as exposed)

Longer-term hardening

• Deploy EDR with osascript/AppleScript and curl-from-Script-Editor telemetry
• Restrict or monitor Script Editor execution via MDM and application controls
• User education: never open or Run downloaded .applescript files; verify wallet download domains

Affected and fixed versions

• Apple — macOS
  Vulnerable versions: all supported versions (user-initiated AppleScript execution bypasses Gatekeeper notarization/quarantine)
  Fixed in: N/A — social-engineering campaign, not a patchable defect
• BlueWallet — BlueWallet Bitcoin Wallet (impersonated, NOT compromised)
  Vulnerable versions: none — legitimate app and supply chain are unaffected; only the brand is abused
  Fixed in: use official bluewallet.io

Timeline of Fake BlueWallet Stealer

• 2026-06-01 Single Telegram bot channel documented as combined exfiltration + RAT C2 with operator commands /info, /exec, /clipboard, /download, /exfil, /selfdestruct.
• 2026-06-01 Hard-coded clipboard-swap addresses extracted — BTC locked-ioc-8, ETH locked-ioc-9, SOL locked-ioc-7.
• 2026-06-01 Second stage locked-ioc-16 analyzed: umask-077 random /tmp working dir, XOR config key 'swckR9JCD2Uu', LaunchAgent persistence, and broad wallet/credential collection recovered.
• 2026-06-01 Dropper 'locked-ioc-10' (SHA-256 locked-ioc-2) identified; runs a base64 one-liner that curls a stage-2 from locked-ioc-14.
• 2026-06-01 Malwarebytes (Stefan Dasic) publishes full technical analysis of the fake BlueWallet AppleScript dropper and second-stage stealer.
• 2026-06-01 Fake BlueWallet site locked-ioc-13 observed actively distributing a macOS stealer to cryptocurrency users by impersonating the legitimate bluewallet.io project.

Sources cited for Fake BlueWallet Stealer

• BlueWallet — official site (legitimate wallet) bluewallet.io · Vendor report · 2026-06-01
• MITRE ATT&CK — T1059.002 AppleScript MITRE · Research · 2026-06-01
• MITRE ATT&CK — T1115 Clipboard Data MITRE · Research · 2026-06-01
• MITRE ATT&CK — T1543.001 Launch Agent MITRE · Research · 2026-06-01
• MITRE ATT&CK — T1553.001 Gatekeeper Bypass MITRE · Research · 2026-06-01
• Fake BlueWallet steals passwords, accounts, and crypto from Macs (Stefan Dasic, Malwarebytes) malwarebytes.com · Blog · 2026-06-01

Threats related to Fake BlueWallet Stealer

• macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS Stealer (AMOS)
• Meow Mac Stealer RAT: macOS ClickFix Lures Deploy AppleScript Infostealer with Persistent RAT Capabilities
• PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords via PAM
• SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and Google-Masquerading LaunchAgent Backdoor
• ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data

Related coverage of this activity

• ASTERIX LLM crypto fraud
• macOS ClickFix campaign
• FakeAgent AI platform malware delivery
• AMOS MacSync 250 ClickFix domains
• ClickFix macOS stealer trio

Previous and next in malware

• SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT via Two-Stage Loader (Unidentified Initial RAT, Encoded TCP/443 C2) Previous report
• EndPoint (formerly Midnight) Babuk-Derived Ransomware — Windows/ESXi/NAS Double Extortion with ChaCha20+RSA Encryption and North Korea-Linked Ransom-Note Lineage (CVE-less, ASEC) Next report