Threat video1:00
Fake BlueWallet macOS Stealer via AppleScript Dropper
A fake BlueWallet site has Macs run an AppleScript that steals crypto wallets. 9 detection rules, 21 IOCs, 20 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for Fake BlueWallet macOS Stealer via AppleScript Dropper →
Chapters
- 0:00The hookFake BlueWallet steals wallet data.
- 0:04The storyFake site steals wallet credentials.
- 0:10Attack pathDownload and run the AppleScript.
- 0:22AttributionNo threat actor is attributed.
- 0:26Indicators of compromise15 indicators to hunt: 1 domain, 1 URL and 1 SHA-256 hash, and more.
- 0:35MITRE ATT&CK techniques20 ATT&CK techniques, from initial access to impact.
- 0:40Remediation4 steps now: Block update-bluewallet[.]com and projects2026box[.]com at DNS/proxy/firewall.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake BlueWallet steals wallet data.
0:05Fake site steals wallet credentials.
0:07Hijacks clipboard addresses.
0:10Download and run the AppleScript.
0:13Stealer harvests wallets, browser data.
0:15Hijacks copied crypto addresses.
0:18Exfiltrates to Telegram bot.
0:22No threat actor is attributed. Confidence: none.
0:2715 indicators to hunt: 1 domain, 1 URL and 1 SHA-256 hash, and more.
0:3520 ATT&CK techniques, from initial access to impact.
0:404 steps now: Block update-bluewallet[.]com and projects2026box[.]com at DNS/proxy/firewall.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.