macOS Info-Stealer Chains Fake Password Prompt, Telegram Session Theft, and Crypto Wallet App Replacement — Threadlinqs Intelligence
As of 2026-07-18, macOS Info-Stealer Chains Fake Password Prompt, Telegram Session Theft, and Crypto Wallet App Replacement is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1494 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
SlowMist's MistEye monitoring identified a multi-stage macOS information-stealing malware that spoofs a 'GAPI_Update' administrator password prompt validated via `dscl . authonly`, harvests
In July 2026, SlowMist's MistEye threat-monitoring platform detected a macOS information stealer executing a five-stage attack chain designed to harvest credentials and drain cryptocurrency wallets. Stage 1 displays a fake system dialog impersonating a 'GAPI_Update' (Google API Connector) update that requests the administrator password; the malware validates any submitted string against the real local account password using `dscl . authonly '<username>' '<password>'`, letting the operators discard junk input and retain only genuine credentials. In parallel it pulls the Keychain-derived Chrome Safe Storage key via `security find-generic-password -ga "Chrome"` and stages it in a temp file named `masterpass-chrome`, and scrapes Login Data/Cookies/Web Data/formhistory.sqlite from Chrome, Brave, Edge, Vivaldi, and Opera, plus logins.json/key4.db from Firefox, along with `Keychains/login.keychain-db`, Safari cookies, and the Apple Notes database at `Group Containers/group.com.apple.notes/NoteStore.sqlite`.
Stage 2 targets `~/Library/Application Support/Telegram Desktop/tdata/`, copying `key_datas` first and then walking the directory to pair matching session-state files and their `maps` mappings. Restoring these files on attacker infrastructure fully resumes the victim's Telegram session and chat history with no phone number, SMS code, or Two-Step Verification password required, and does not force a server-side logout. The stolen `tdata` is convertible into a programmable Telegram API session using the opentele/Telethon libraries and an existing AuthKey, enabling low-frequency, intermittent attacker connections that evade behavioral detection — this also affects Telegram's native Swift macOS client, whose locally cached history remains readable even after the account is flagged.
Stage 3 exfiltrates local data from 16 named cryptocurrency wallet applications (Electrum, Coinomi, Exodus, Atomic, Wasabi, Monero, Electrum-LTC, Electron Cash, Guarda, Sparrow, Bitcoin Core, Litecoin Core, Dash Core, Dogecoin Core, Ledger Live, Trezor Suite) and scans 223 wallet-related browser extension IDs across Chromium-based browsers for localStorage/IndexedDB artifacts, deliberately skipping Cache/Code Cache/Crashpad/journals/media/calls to reduce exfil volume.
Stage 4 performs offline decryption: e.g. Atomic Wallet 2.70's AES-256-CBC-protected LevelDB store is attacked using a candidate password list built from Keychain, browser password managers, Apple Notes, and the spoofed prompt — maximizing the odds of recovering private keys/seed phrases without triggering online rate limiting. Because keys are already exfiltrated, post-incident password changes on the wallet app do not invalidate the compromised material.
Stage 5 replaces Ledger Live, Ledger Wallet, and Trezor Suite outright: the malware downloads `ledger.zip`, `ledgerwallet.zip`, and `trezor.zip` via `curl` into `/tmp`, kills the running legitimate apps with `pkill`, removes them with `rm -rf`, escalates via `sudo`, and unpacks the replacements into `/Applications` with `ditto`. The replacements read a hidden, XOR-encoded configuration to build a remote route (`/ledger` or `/trezor`), then load it in a `WKWebView` with JavaScript enabled — the app has no real hardware-wallet functionality (no USB/HID, no BIP32/BIP39 derivation, no transaction signing) and is purely a remotely-updatable phishing surface, letting operators change the lure without redeploying the binary. Confirmed C2/hosting infrastructure includes 192.253.248.181 (archive hosting) and 86.54.25.213 (phishing route + logging endpoint, observed serving `/ledger?username=night`, `/trezor?username=night`, and `/log`).
SlowMist reports no CVE is involved — this is a technique-based campaign, not a software vulnerability — and provides no specific threat-actor attribution, characterizing the operation as indiscriminate harvesting targeting cryptocurrency users. SlowMist references a related prior campaign, 'Analysis of a Google S
Target sectors: cryptocurrency, finance, individual-consumers, web3
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195, T1204, T1547, T1548, T1036, T1140, T1555, T1555, T1187, T1056