macOS Info-Stealer Chains Fake Password Prompt, Telegram Session Theft, and Crypto Wallet App Replacement

macOS Info-Stealer Chains Fake Password Prompt, Telegram (TL-2026-1494), also tracked as GAPI_Update macOS Infostealer, is a high-severity malware campaign, first published 2026-07-16. It has no confirmed attribution, affects Apple macOS, maps to 19 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-1494

Threat ID
TL-2026-1494
Also known as
GAPI_Update macOS Infostealer, MistEye macOS Wallet-Swap Stealer, Google API Connector Password Prompt Malware
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cryptocurrency, finance, individual-consumers, web3
Target regions
Global
Detection rules
9
Indicators of compromise
28

Malware and tooling in macOS Info-Stealer Chains Fake Password Prompt, Telegram

Malware and tooling: WKWebView

SlowMist's MistEye monitoring identified a multi-stage macOS information-stealing malware that spoofs a 'GAPI_Update' administrator password prompt validated via `dscl . authonly`, harvests Keychain/browser/Apple Notes credentials, hijacks Telegram Desktop sessions by copying the `tdata` directory (bypassing 2FA), exfiltrates and offline-decrypts data from 16 cryptocurrency wallet applications plus 223 wallet browser-extension IDs, and finally replaces Ledger Live, Ledger Wallet, and Trezor Suite with malicious WKWebView-based phishing loaders.

How macOS Info-Stealer Chains Fake Password Prompt, Telegram works

In July 2026, SlowMist's MistEye threat-monitoring platform detected a macOS information stealer executing a five-stage attack chain designed to harvest credentials and drain cryptocurrency wallets. Stage 1 displays a fake system dialog impersonating a 'GAPI_Update' (Google API Connector) update that requests the administrator password; the malware validates any submitted string against the real local account password using `dscl . authonly '<username>' '<password>'`, letting the operators discard junk input and retain only genuine credentials. In parallel it pulls the Keychain-derived Chrome Safe Storage key via `security find-generic-password -ga "Chrome"` and stages it in a temp file named `masterpass-chrome`, and scrapes Login Data/Cookies/Web Data/formhistory.sqlite from Chrome, Brave, Edge, Vivaldi, and Opera, plus logins.json/key4.db from Firefox, along with `Keychains/login.keychain-db`, Safari cookies, and the Apple Notes database at `Group Containers/group.com.apple.notes/NoteStore.sqlite`.

Stage 2 targets `~/Library/Application Support/Telegram Desktop/tdata/`, copying `key_datas` first and then walking the directory to pair matching session-state files and their `maps` mappings. Restoring these files on attacker infrastructure fully resumes the victim's Telegram session and chat history with no phone number, SMS code, or Two-Step Verification password required, and does not force a server-side logout. The stolen `tdata` is convertible into a programmable Telegram API session using the opentele/Telethon libraries and an existing AuthKey, enabling low-frequency, intermittent attacker connections that evade behavioral detection — this also affects Telegram's native Swift macOS client, whose locally cached history remains readable even after the account is flagged.

Stage 3 exfiltrates local data from 16 named cryptocurrency wallet applications (Electrum, Coinomi, Exodus, Atomic, Wasabi, Monero, Electrum-LTC, Electron Cash, Guarda, Sparrow, Bitcoin Core, Litecoin Core, Dash Core, Dogecoin Core, Ledger Live, Trezor Suite) and scans 223 wallet-related browser extension IDs across Chromium-based browsers for localStorage/IndexedDB artifacts, deliberately skipping Cache/Code Cache/Crashpad/journals/media/calls to reduce exfil volume.

Stage 4 performs offline decryption: e.g. Atomic Wallet 2.70's AES-256-CBC-protected LevelDB store is attacked using a candidate password list built from Keychain, browser password managers, Apple Notes, and the spoofed prompt — maximizing the odds of recovering private keys/seed phrases without triggering online rate limiting. Because keys are already exfiltrated, post-incident password changes on the wallet app do not invalidate the compromised material.

Stage 5 replaces Ledger Live, Ledger Wallet, and Trezor Suite outright: the malware downloads `ledger.zip`, `ledgerwallet.zip`, and `trezor.zip` via `curl` into `/tmp`, kills the running legitimate apps with `pkill`, removes them with `rm -rf`, escalates via `sudo`, and unpacks the replacements into `/Applications` with `ditto`. The replacements read a hidden, XOR-encoded configuration to build a remote route (`/ledger` or `/trezor`), then load it in a `WKWebView` with JavaScript enabled — the app has no real hardware-wallet functionality (no USB/HID, no BIP32/BIP39 derivation, no transaction signing) and is purely a remotely-updatable phishing surface, letting operators change the lure without redeploying the binary. Confirmed C2/hosting infrastructure includes 192.253.248.181 (archive hosting) and 86.54.25.213 (phishing route + logging endpoint, observed serving `/ledger?username=night`, `/trezor?username=night`, and `/log`).

SlowMist reports no CVE is involved — this is a technique-based campaign, not a software vulnerability — and provides no specific threat-actor attribution, characterizing the operation as indiscriminate harvesting targeting cryptocurrency users. SlowMist references a related prior campaign, 'Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware,' suggesting a broader ongoing operation against macOS crypto users delivered via trojanized/phishing application distribution.

MITRE ATT&CK techniques used in TL-2026-1494

Collection

T1005 Data from Local System; T1074 Data Staged; T1115 Clipboard Data

Defense Evasion

T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Credential Access

T1056 Input Capture; T1187 Forced Authentication; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1195 Supply Chain Compromise

Execution

T1204 User Execution

Persistence

T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Impact

T1657 Financial Theft

Affected products and versions in macOS Info-Stealer Chains Fake Password Prompt, Telegram

  • Apple — macOS
    Vulnerable versions: all supported versions (technique-based, not version-specific)
  • Telegram FZ-LLC — Telegram Desktop (macOS)
    Vulnerable versions: all versions using tdata session storage
  • Ledger — Ledger Live
    Vulnerable versions: replaced/impersonated by malware
  • Ledger — Ledger Wallet
    Vulnerable versions: replaced/impersonated by malware
  • SatoshiLabs — Trezor Suite
    Vulnerable versions: replaced/impersonated by malware
  • Google — Chrome
    Vulnerable versions: all versions (credential store targeted)
  • Brave Software — Brave Browser
    Vulnerable versions: all versions
  • Microsoft — Edge
    Vulnerable versions: all versions (macOS)
  • Vivaldi Technologies — Vivaldi Browser
    Vulnerable versions: all versions
  • Opera — Opera Browser
    Vulnerable versions: all versions

Remediation for macOS Info-Stealer Chains Fake Password Prompt, Telegram

Immediate actions

  • Block outbound traffic to 192.253.248.181 and 86.54.25.213 at the network perimeter
  • Verify Ledger Live, Ledger Wallet, and Trezor Suite installations against official checksums/notarization; reinstall from vendor sources if replaced
  • Terminate and re-authenticate all Telegram Desktop sessions from Settings > Devices; revoke unrecognized active sessions
  • Rotate all credentials stored in Keychain and browser password managers on any macOS host that displayed an unexpected admin-password prompt
  • Move any cryptocurrency held in the 16 targeted wallet applications to a newly generated wallet/seed on a clean device; treat existing seeds/private keys as compromised regardless of password changes
  • Hunt for `masterpass-chrome` temp files, unexpected `dscl . authonly` invocations, and `curl`/`ditto`/`pkill` chains targeting /Applications/Ledger* and /Applications/Trezor*

Workarounds

  • Use full-disk encryption plus a distinct macOS login/Keychain password not reused for wallet applications to limit single-password blast radius
  • Store cryptocurrency seed phrases exclusively offline (never in Notes, browser storage, or password managers) to prevent Stage 4 offline decryption

Longer-term hardening

  • Deploy EDR with behavioral detection for Keychain API abuse (security find-generic-password), fake authorization-prompt patterns, and mass browser-profile file access
  • Enforce Gatekeeper/notarization verification and application allow-listing for wallet and Telegram binaries
  • Educate crypto-holding users on the GAPI_Update / Google API Connector social-engineering lure and on never re-entering admin credentials into unexpected system dialogs
  • Monitor for anomalous low-frequency Telegram API session activity indicative of stolen tdata reuse (opentele/Telethon patterns)
  • Adopt hardware-wallet transaction verification workflows that do not rely solely on the companion desktop app UI

Timeline of macOS Info-Stealer Chains Fake Password Prompt, Telegram

  • Follow-on coverage published by CyberPress, GBHackers, TradingView/Cointelegraph, and Whale Alert summarizing SlowMist's findings and IOCs.
  • SlowMist publishes 'Telegram Account Compromised, Wallet Swapped' on Medium, cross-referencing a related prior report on a Google Sites phishing campaign delivering similar macOS stealers.
  • Phishing/logging infrastructure identified at 86.54.25.213 serving /ledger, /trezor, and /log routes.
  • Stage 5 confirmed: malware downloads ledger.zip, ledgerwallet.zip, and trezor.zip from 192.253.248.181, removes legitimate Ledger Live/Ledger Wallet/Trezor Suite via pkill+rm+sudo, and installs WKWebView phishing loaders via ditto.
  • Stage 4 confirmed: offline AES-256-CBC decryption attempted against Atomic Wallet 2.70's LevelDB store using harvested candidate passwords.
  • Stage 3 confirmed: local data theft from 16 cryptocurrency wallet applications and scanning of 223 wallet browser-extension IDs across Chromium browsers.
  • Stage 2 confirmed: malware copies Telegram Desktop's tdata directory (key_datas, session files, maps) enabling full session restoration without 2FA on attacker systems.
  • Analysis confirms Stage 1: fake 'GAPI_Update' admin password prompt validated via `dscl . authonly`, plus Keychain, browser, and Apple Notes credential harvesting.
  • SlowMist's MistEye monitoring system detects the macOS information-stealing malware and triggers an investigation.

Sources cited for macOS Info-Stealer Chains Fake Password Prompt, Telegram

Threats related to macOS Info-Stealer Chains Fake Password Prompt, Telegram

Detection coverage for TL-2026-1494

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1494 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1494

4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats