Home›Crypto›Regulation›macOS malware hijacks Telegram sessions and targets cr…

macOS malware hijacks Telegram sessions and targets crypto wallets

SlowMist says the malware can reuse an already authenticated Telegram Desktop session, bypassing two-step verification, and then use stolen data to decrypt wallet databases offline or prompt users for recovery phrases.

Reported · Written up by our desk · Regulation

Blockchain security firm SlowMist says a macOS information-stealing malware can hijack Telegram Desktop sessions and compromise cryptocurrency wallets by harvesting credentials and session data.

According to SlowMist, the malware collects data from macOS Keychain, Safari cookies, Apple Notes, Telegram Desktop, and wallet databases linked to more than a dozen crypto wallets. After stealing passwords and authenticated sessions, it copies authenticated Telegram Desktop session data, wallet databases, and browser wallet extension data, enabling further account takeovers.

SlowMist adds that attackers can attempt to decrypt stolen wallet databases offline using harvested passwords, or they can replace legitimate Ledger and Trezor applications with fake versions designed to trick users into entering wallet recovery phrases. The firm says the targets include software wallets such as Exodus, Atomic, Electrum, Wasabi and Monero, as well as hardware wallet apps like Ledger Live and Trezor Suite.

SlowMist says Telegram two-step verification does not stop the attack because the malware reuses an authenticated local session rather than creating a new login. In tests, researchers restored stolen Telegram Desktop session data on another Mac without entering a phone number, verification code, or the two-step verification password.

More like this

Sources