# Fake BlueWallet macOS Stealer — AppleScript Dropper Delivers Infostealer with Clipboard Crypto-Address Hijack and Telegram C2

> A fake site impersonating the legitimate BlueWallet Bitcoin wallet (update-bluewallet[.]com) social-engineers macOS users into opening a downloaded 'BlueWallet Installer.applescript' in Script Editor and pressing Run/⌘R, sidestepping Gatekeeper notarization and quarantine. A base64-encoded shell one-liner fetches a second-stage stealer (/tmp/.sysupd.sh) that harvests passwords, browser data, 19+ desktop and browser-extension crypto wallets, six password managers, 2FA apps, and SSH/AWS/GnuPG/Kube/Git credentials, while hijacking the clipboard to swap copied BTC/ETH/SOL addresses for attacker-controlled ones. Exfiltration and interactive control run over a single Telegram bot channel. BlueWallet itself is not compromised.

- **Published:** 2026-06-01T00:00:00Z
- **Last reviewed:** 2026-06-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0648
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-fake-bluewallet-stealer-tl-2026-0648.webp?v=83abaa15 (Threadlinqs threat intel: Fake BlueWallet macOS Stealer via AppleScript Dropper (TL-2026-0648) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-0648
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

Researchers at Malwarebytes (Stefan Dasic, 2026-06-01) documented an active macOS social-engineering campaign distributing a credential- and crypto-stealing payload under the guise of the legitimate open-source BlueWallet Bitcoin wallet. The genuine project lives at bluewallet.io; the attacker-controlled lookalike update-bluewallet[.]com mimics its branding and auto-downloads a malicious file on a two-second timer. Critically, the campaign does NOT compromise BlueWallet or its supply chain — it abuses brand trust to socially engineer victims.

Initial access and execution: Rather than shipping a notarized app (which Gatekeeper would scrutinize), the site delivers 'BlueWallet Installer.applescript' (SHA-256 216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61) and instructs the victim to open it in Apple's Script Editor and press the Run button (⌘R). Because the user manually executes the script inside a trusted developer tool, macOS notarization and the com.apple.quarantine attribute are never enforced against a packaged binary — a deliberate Gatekeeper-bypass-by-design. The AppleScript carries a base64-encoded shell one-liner that, once decoded at runtime, uses curl to pull a second stage from https://projects2026box[.]com/serve_site/confighelper_0adfeee8.sh.

Second stage: The downloaded shell script is written to the hidden path /tmp/.sysupd.sh and executed. It creates a randomly-named working directory under /tmp (seeded from /dev/urandom with umask 077 so artifacts are non-predictable and private to the user), decodes its runtime configuration with an internal '_xd' routine using the XOR key 'swckR9JCD2Uu', and establishes persistence via a property-list-backed LaunchAgent in ~/Library/LaunchAgents with a hidden support directory so it re-launches at login.

Collection: The stealer enumerates and exfiltrates a broad credential surface — system/login passwords and browser-stored data (cookies, saved passwords, autofill, history); 12+ desktop wallets (Electrum, Exodus, Atomic Wallet, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, BlueWallet, Trust Wallet, Zengo, Monero, Sparrow); 15 browser-extension wallets across Bitcoin (Xverse, Leather, UniSat, Alby, Wizz), Solana (Phantom, Solflare, Backpack, MagicEden), and EVM (MetaMask, OKX, Coinbase Wallet, Rabby, Zerion, Rainbow); six password managers (LastPass, 1Password, Dashlane, Bitwarden, Keeper, NordPass); three 2FA apps (Google Authenticator, Authy, Microsoft Authenticator); and developer/cloud credentials in ~/.ssh, ~/.aws, ~/.gnupg, ~/.kube, and ~/.gitconfig.

Clipboard crypto-address hijack (clipper): Beyond bulk theft, the malware continuously monitors the clipboard and, when it detects a cryptocurrency address being copied, silently substitutes an attacker-controlled address so funds sent by the victim are redirected. The hard-coded swap destinations recovered from the stage-2 sample are BTC bc1qrmj4ggshddhnxx3rxwvsu8pe9ut6cgx8mx364e, ETH 0x2B871703122064e45d77146a6D5203da3bD192FA, and SOL 8dtdRQePrKz97FszwMEa4QvptdAAcbAFs7kBojr5Mz3v.

C2 and RAT capability: Exfiltration and live operator control share a single Telegram bot channel (Telegram Bot API over api.telegram.org). The operator can issue interactive commands — /info, /exec, /clipboard, /download, /exfil, and /selfdestruct — turning the stealer into a lightweight remote-access tool that can run arbitrary commands, pull additional files, read the clipboard on demand, and wipe itself. Attribution is unestablished; the tooling, broad wallet targeting, clipper, and Telegram C2 are consistent with a financially-motivated commodity macOS stealer operation and distinct from prior tracked macOS ClickFix/AppleScript stealers (TL-2026-0336/0348/0396/0471).

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566 Phishing
- T1204.002 User Execution: Malicious File
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1543.001 Create or Modify System Process: Launch Agent
- T1553.001 Subvert Trust Controls: Gatekeeper Bypass
- T1140 Deobfuscate/Decode Files or Information
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1552.001 Unsecured Credentials: Credentials In Files
- T1539 Steal Web Session Cookie
- T1115 Clipboard Data
- T1005 Data from Local System
- T1102.002 Web Service: Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1567 Exfiltration Over Web Service
- T1565.002 Data Manipulation: Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake BlueWallet Stage-2 — /tmp/.sysupd.sh Exec, Hidden umask-077 Workdir & Credential-Store Sweep (Post-Exploitation)** (`TL-2026-0648-SPL-002`)

Detects TL-2026-0648 second-stage activity: execution of the hidden /tmp/.sysupd.sh stealer, creation of a /dev/urandom-seeded umask-077 hidden working directory under /tmp, and rapid read access across the targeted ~/.ssh ~/.aws ~/.gnupg ~/.kube ~/.gitconfig developer/cloud credential stores. Surfaces the broad credential-collection burst that follows the dropper.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1564.001, T1140, T1552.001, T1555.003
- **Data sources:** osquery, macos_unified_log, edr
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=macos sourcetype="osquery:results" (name=process_events OR name=file_events)
| rename columns.cmdline as cmdline columns.path as path columns.target_path as target_path columns.action as action
| eval ind=case(match(cmdline,"/tmp/\.sysupd\.sh"),"stage2_exec", match(target_path,"^/Users/[^/]+/\.(ssh|aws|gnupg|kube|gitconfig)"),"cred_store_access", match(target_path,"^/tmp/\.[0-9a-f]{8,}"),"hidden_workdir")
| where isnotnull(ind)
| stats dc(ind) as indicator_types values(ind) as indicators values(target_path) as paths values(cmdline) as cmdlines min(_time) as firstTime max(_time) as lastTime by host
| where indicator_types>=2
| eval phase="post-exploitation", threat="TL-2026-0648 Fake BlueWallet Stealer"
| convert ctime(firstTime) ctime(lastTime)
| table host indicators paths cmdlines indicator_types firstTime lastTime phase threat
```

### Microsoft KQL

```kql
let creds = dynamic([".ssh", ".aws", ".gnupg", ".kube", ".gitconfig"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where (FolderPath has "/tmp/.sysupd.sh")
    or (FolderPath matches regex @"/Users/[^/]+/\.(ssh|aws|gnupg|kube|gitconfig)")
    or (FolderPath matches regex @"^/private/tmp/\.[0-9a-f]{8,}" or FolderPath matches regex @"^/tmp/\.[0-9a-f]{8,}")
| extend Indicator = case(
    FolderPath has "/tmp/.sysupd.sh", "stage2",
    FolderPath matches regex @"\.(ssh|aws|gnupg|kube|gitconfig)", "cred_store",
    "hidden_workdir")
| summarize IndicatorTypes = dcount(Indicator), Indicators = make_set(Indicator), Paths = make_set(FolderPath), Start = min(Timestamp), End = max(Timestamp) by DeviceName, InitiatingProcessFileName
| where IndicatorTypes >= 2
```

### Sigma

```yaml
title: Fake BlueWallet Stage-2 — /tmp/.sysupd.sh Exec and Credential-Store Sweep
id: 1b4e2d3f-8c25-4e0b-ac32-7f1b3e6d2f02
status: experimental
description: Detects the TL-2026-0648 second-stage stealer — execution of hidden /tmp/.sysupd.sh, a umask-077 /dev/urandom-named hidden /tmp working directory, and rapid access to ~/.ssh ~/.aws ~/.gnupg ~/.kube ~/.gitconfig credential stores.
references:
    - https://www.malwarebytes.com/blog/threat-intel/2026/06/fake-bluewallet-steals-passwords-accounts-and-crypto-from-macs
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/01
tags:
    - attack.execution
    - attack.defense_evasion
    - attack.credential_access
    - attack.t1059.004
    - attack.t1564.001
    - attack.t1552.001
    - attack.t1555.003
logsource:
    product: macos
    category: process_creation
detection:
    selection_stage2:
        CommandLine|contains: '/tmp/.sysupd.sh'
    selection_credsweep:
        CommandLine|contains:
            - '/.ssh'
            - '/.aws'
            - '/.gnupg'
            - '/.kube'
            - '/.gitconfig'
    condition: selection_stage2 or selection_credsweep
falsepositives:
    - Backup or sync tooling reading multiple dotfile credential stores (correlate with /tmp/.sysupd.sh execution to confirm)
level: high
```

**Known false positives:**

- Backup/sync agents (e.g. rsync, cloud backup) touching multiple credential dotfiles in succession — correlate with /tmp/.sysupd.sh execution
- Developer tooling enumerating ~/.aws or ~/.kube profiles

**Tuning notes:** Require >=2 distinct indicator types to reduce noise from single legitimate credential reads. Tighten the hidden-workdir regex to your /tmp vs /private/tmp normalization. Add ~/Library/Application Support browser wallet paths to extend collection coverage.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake BlueWallet AppleScript Dropper — Script Editor/osascript -> curl Stage-1 Fetch (Exploitation) (locked: unlock with TL Creds)
- Fake BlueWallet Persistence & Hidden Stage-2 — com.apple.sysupd LaunchAgent and [indicator] (Post-Exploitation) (locked: unlock with TL Creds)
- Fake BlueWallet Telegram C2 & Clipper — Non-Browser [indicator] Beacon and Swap-Address Clipboard (C2) (locked: unlock with TL Creds)
- Fake BlueWallet AppleScript Dropper — osascript/Script Editor -> curl Stage-1 (Sigma, Exploitation) (locked: unlock with TL Creds)
- Fake BlueWallet Persistence & Credential Sweep — LaunchAgent + XOR Stage-2 (Sigma, Post-Exploitation) (locked: unlock with TL Creds)
- Fake BlueWallet Clipper & Telegram C2 — Swap Addresses + [indicator] (Sigma, C2/Lateral Movement) (locked: unlock with TL Creds)
- Fake BlueWallet AppleScript Dropper — Script Editor/osascript Spawning curl to Stage-1 Host (Exploitation) (locked: unlock with TL Creds)
- Fake BlueWallet Clipper & Telegram C2 — Clipboard Crypto-Swap Addresses and [indicator] Beacon (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- Domain: `update-bluewallet[.]com`
- File hash: `216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61`
- Domain: `projects2026box[.]com`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake BlueWallet steals passwords, accounts, and crypto from Macs (Stefan Dasic, Malwarebytes)](https://www.malwarebytes.com/blog/threat-intel/2026/06/fake-bluewallet-steals-passwords-accounts-and-crypto-from-macs)
- [BlueWallet — official site (legitimate wallet)](https://bluewallet.io/)
- [MITRE ATT&CK — T1059.002 AppleScript](https://attack.mitre.org/techniques/T1059/002/)
- [MITRE ATT&CK — T1115 Clipboard Data](https://attack.mitre.org/techniques/T1115/)
- [MITRE ATT&CK — T1543.001 Launch Agent](https://attack.mitre.org/techniques/T1543/001/)
- [MITRE ATT&CK — T1553.001 Gatekeeper Bypass](https://attack.mitre.org/techniques/T1553/001/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0648