# macOS Infostealer Hijacks Telegram Desktop Sessions via tdata Theft to Bypass 2FA, Harvests Keychain, Browser Credentials, Apple Notes, and 16 Crypto Wallets

> SlowMist reproduced a macOS infostealer technique that copies Telegram Desktop's local 'tdata' directory (key_datas, maps, and session state files) from an infected Mac and restores it on an attacker-controlled machine, resuming an authenticated Telegram session without triggering a login prompt, SMS code, or Two-Step Verification password when the victim has not set a separate Telegram Desktop passcode. The same malware family harvests macOS Keychain data, Safari/Chromium browser credentials, Apple Notes content, and 16+ cryptocurrency wallet databases, and replaces legitimate Ledger Live/Trezor Suite apps with trojanized WKWebView phishing clones.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1424
- **ID:** TL-2026-1424
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In July 2026, SlowMist's MistEye monitoring platform detected a macOS information-stealing malware campaign and published two related technical analyses: an initial report on a Google Sites community-application phishing campaign delivering the stealer, and a follow-up specifically detailing Telegram Desktop session (tdata) compromise and cryptocurrency wallet swapping. The malware does not exploit a code vulnerability or crack Telegram's cryptography; instead it abuses the portability of Telegram Desktop's local session state. Telegram Desktop stores an AES key in a file named key_datas inside ~/Library/Application Support/Telegram Desktop/tdata/, alongside session-mapping files (maps) and per-account state files matching an <name>s naming pattern. An attacker who exfiltrates this directory can restore it on a compatible machine and inherit the victim's live, already-authorized session — the client does not request a phone number, SMS code, or Telegram Two-Step Verification password on restoration, because from Telegram's server-side perspective this is simply the same authorized session continuing to poll. SlowMist confirmed this on macOS 12.7 with Telegram Desktop 4.16, and noted both the Qt-based Telegram Desktop client and the native Swift-based Telegram for macOS client are susceptible; the native client additionally persists cached conversation data locally even after server-side session termination. Once obtained, tdata can be converted into a fully programmatic Telegram API session using open-source tooling (opentele, Telethon) combined with the already-authorized AuthKey and official client API parameters, letting an attacker read message history, exfiltrate media, and interact with contacts entirely outside the Telegram Desktop UI. The broader malware is consistent in tooling, infrastructure pattern, and behavior with the 'Odyssey Stealer' macOS malware-as-a-service operation reported independently by Censys, GBHackers, and Cyberpress in the same period: a fake 'GAPI_Update' administrator-password prompt that validates the entered credential via `dscl . authonly` and then uses it to unlock the Keychain (`security find-generic-password -ga \"Chrome\"` to obtain the Chrome Safe Storage key), systematic harvesting of Chrome/Brave/Edge/Vivaldi/Opera Login Data, Cookies, Web Data and Firefox logins.json/key4.db, Apple Notes database extraction, LevelDB wallet-store copying with offline AES-256-CBC decryption attempts using harvested passwords as candidates, and termination/replacement of legitimate Ledger Live and Trezor Suite applications (via pkill, sudo rm -rf, and ditto extraction) with trojanized WKWebView/SwiftUI clones that phish for hardware-wallet recovery phrases through fake recovery-workflow pages. Stolen data is zip-compressed and POSTed to a C2 /log endpoint identical in structure to IOCs published in the Telegram-specific SlowMist report. The wider Odyssey Stealer operation runs a MaaS affiliate model: delivery via obfuscated AppleScript wrapped in shell scripts distributed through phishing/malvertising with per-affiliate download paths (/d/{affiliate}{campaign_id}), boot persistence via a randomly-labeled LaunchDaemon (com.{random_5-digit}) that polls a disk-stored C2 URL (/.chost) every 60 seconds via osascript, and supports remote commands for reinfection (repeat), arbitrary shell execution (doshell), SOCKS5 proxy tunneling (enablesocks5), and self-removal (uninstall). No CVE applies: this is an abuse of session-file portability and social-engineering/credential-harvesting technique rather than a software vulnerability.

## MITRE ATT&CK

- T1566 Phishing
- T1566.002 Spearphishing Link
- T1059.002 AppleScript
- T1059.004 Unix Shell
- T1543.004 Launch Daemon
- T1547.013 XDG Autostart Entries
- T1548 Abuse Elevation Control Mechanism
- T1036.004 Masquerade Task or Service
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1187 Forced Authentication
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1090.001 Internal Proxy
- T1105 Ingress Tool Transfer
- T1570 Lateral Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft
- T1531 Account Access Removal

## Sources

- [Hackers 'Crack' Telegram 2FA](https://cybersecuritynews.com/hackers-crack-telegram-2fa/)
- [Telegram Account Compromised, Wallet Swapped: How Does macOS Malware Break Through Your Defenses?](https://slowmist.medium.com/telegram-account-compromised-wallet-swapped-how-does-macos-malware-break-through-your-defenses-dad9bfed9c02)
- [Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware](https://slowmist.medium.com/analysis-of-a-google-sites-community-application-phishing-campaign-and-macos-information-stealing-43ed1b04a1da)
- [Odyssey Stealer: Inside a macOS Crypto-Stealing Operation](https://censys.com/blog/odyssey-stealer-inside-a-macos-crypto-stealing-operation/)
- [Odyssey Stealer Hits macOS Users in 100+ Countries, Targets 300 Crypto Wallet Extensions](https://cybersecuritynews.com/odyssey-stealer-hits-macos-users/)
- [Odyssey Stealer Hits 100+ Countries, Targets 16+ Crypto Wallet Apps on macOS](https://cryptonews.net/news/security/33125030/)
- [Odyssey Trojan Targets macOS, Steals Crypto Wallets](https://phemex.com/news/article/odyssey-trojan-targets-macos-users-steals-crypto-wallets-and-data-92351)
- [Odyssey Stealer: macOS Crypto Wallet Theft via MaaS](https://socprime.com/active-threats/odyssey-stealer-analysis/)
- [Odyssey Infostealer Targets macOS Keychain and Cryptocurrency Wallets in Global Attacks](https://cyberpress.org/odyssey-steals-mac-crypto-wallets/)
- [Odyssey Stealer Attacks Macs Worldwide and Replaces Crypto Wallet Apps With Drainers](https://gbhackers.com/odyssey-stealer-attacks-macs/)
- [Security researchers warn against Odyssey Infostealer targeting macOS users for crypto theft](https://www.technewshub.co.uk/post/security-researchers-warn-against-odyssey-infostealer-targeting-macos-users-for-crypto-theft)
- [Odyssey Stealer (Mac) - Removal steps, and macOS cleanup](https://www.pcrisk.com/removal-guides/32538-odyssey-stealer-mac)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1424