# macOS Info-Stealer Chains Fake Password Prompt, Telegram Session Theft, and Crypto Wallet App Replacement

> SlowMist's MistEye monitoring identified a multi-stage macOS information-stealing malware that spoofs a 'GAPI_Update' administrator password prompt validated via `dscl . authonly`, harvests Keychain/browser/Apple Notes credentials, hijacks Telegram Desktop sessions by copying the `tdata` directory (bypassing 2FA), exfiltrates and offline-decrypts data from 16 cryptocurrency wallet applications plus 223 wallet browser-extension IDs, and finally replaces Ledger Live, Ledger Wallet, and Trezor Suite with malicious WKWebView-based phishing loaders.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1494
- **ID:** TL-2026-1494
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In July 2026, SlowMist's MistEye threat-monitoring platform detected a macOS information stealer executing a five-stage attack chain designed to harvest credentials and drain cryptocurrency wallets. Stage 1 displays a fake system dialog impersonating a 'GAPI_Update' (Google API Connector) update that requests the administrator password; the malware validates any submitted string against the real local account password using `dscl . authonly '<username>' '<password>'`, letting the operators discard junk input and retain only genuine credentials. In parallel it pulls the Keychain-derived Chrome Safe Storage key via `security find-generic-password -ga "Chrome"` and stages it in a temp file named `masterpass-chrome`, and scrapes Login Data/Cookies/Web Data/formhistory.sqlite from Chrome, Brave, Edge, Vivaldi, and Opera, plus logins.json/key4.db from Firefox, along with `Keychains/login.keychain-db`, Safari cookies, and the Apple Notes database at `Group Containers/group.com.apple.notes/NoteStore.sqlite`.

Stage 2 targets `~/Library/Application Support/Telegram Desktop/tdata/`, copying `key_datas` first and then walking the directory to pair matching session-state files and their `maps` mappings. Restoring these files on attacker infrastructure fully resumes the victim's Telegram session and chat history with no phone number, SMS code, or Two-Step Verification password required, and does not force a server-side logout. The stolen `tdata` is convertible into a programmable Telegram API session using the opentele/Telethon libraries and an existing AuthKey, enabling low-frequency, intermittent attacker connections that evade behavioral detection — this also affects Telegram's native Swift macOS client, whose locally cached history remains readable even after the account is flagged.

Stage 3 exfiltrates local data from 16 named cryptocurrency wallet applications (Electrum, Coinomi, Exodus, Atomic, Wasabi, Monero, Electrum-LTC, Electron Cash, Guarda, Sparrow, Bitcoin Core, Litecoin Core, Dash Core, Dogecoin Core, Ledger Live, Trezor Suite) and scans 223 wallet-related browser extension IDs across Chromium-based browsers for localStorage/IndexedDB artifacts, deliberately skipping Cache/Code Cache/Crashpad/journals/media/calls to reduce exfil volume.

Stage 4 performs offline decryption: e.g. Atomic Wallet 2.70's AES-256-CBC-protected LevelDB store is attacked using a candidate password list built from Keychain, browser password managers, Apple Notes, and the spoofed prompt — maximizing the odds of recovering private keys/seed phrases without triggering online rate limiting. Because keys are already exfiltrated, post-incident password changes on the wallet app do not invalidate the compromised material.

Stage 5 replaces Ledger Live, Ledger Wallet, and Trezor Suite outright: the malware downloads `ledger.zip`, `ledgerwallet.zip`, and `trezor.zip` via `curl` into `/tmp`, kills the running legitimate apps with `pkill`, removes them with `rm -rf`, escalates via `sudo`, and unpacks the replacements into `/Applications` with `ditto`. The replacements read a hidden, XOR-encoded configuration to build a remote route (`/ledger` or `/trezor`), then load it in a `WKWebView` with JavaScript enabled — the app has no real hardware-wallet functionality (no USB/HID, no BIP32/BIP39 derivation, no transaction signing) and is purely a remotely-updatable phishing surface, letting operators change the lure without redeploying the binary. Confirmed C2/hosting infrastructure includes 192.253.248.181 (archive hosting) and 86.54.25.213 (phishing route + logging endpoint, observed serving `/ledger?username=night`, `/trezor?username=night`, and `/log`).

SlowMist reports no CVE is involved — this is a technique-based campaign, not a software vulnerability — and provides no specific threat-actor attribution, characterizing the operation as indiscriminate harvesting targeting cryptocurrency users. SlowMist references a related prior campaign, 'Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware,' suggesting a broader ongoing operation against macOS crypto users delivered via trojanized/phishing application distribution.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1187 Forced Authentication
- T1056 Input Capture
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1074 Data Staged
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Telegram Account Compromised, Wallet Swapped: How Does macOS Malware Break Through Your Defenses?](https://slowmist.medium.com/telegram-account-compromised-wallet-swapped-how-does-macos-malware-break-through-your-defenses-dad9bfed9c02?source=rss-4ceeedda40e8------2)
- [Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware](https://slowmist.medium.com/analysis-of-a-google-sites-community-application-phishing-campaign-and-macos-information-stealing-43ed1b04a1da)
- [macOS Infostealer Steals Telegram Sessions and Replaces Ledger and Trezor Wallet Apps](https://cyberpress.org/infostealer-hijacks-telegram-wallets/)
- [Hackers Pair Stolen Wallet Databases With Keychain Passwords for Offline Crypto Theft](https://gbhackers.com/hackers-pair-stolen-wallet-databases/)
- [MacOS malware hijacks Telegram sessions, targets crypto wallets: SlowMist](https://www.tradingview.com/news/cointelegraph:0d2c43f49094b:0-macos-malware-hijacks-telegram-sessions-targets-crypto-wallets-slowmist/)
- [SlowMist warns macOS malware can steal Telegram sessions and wallet data to compromise crypto wallets](https://whale-alert.io/stories/90cf012cb4dbe3/SlowMist-warns-macOS-malware-can-steal-Telegram-sessions-and-wallet-data-to-compromise-crypto-wallets)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1494