Security researchers at SlowMist have uncovered a dangerous new malware campaign specifically engineered to compromise MacOS environments. By covertly accessing Telegram sessions, the attackers gain a foothold to manipulate user accounts and compromise sensitive digital assets.
The malicious software employs advanced tactics to decrypt local cryptocurrency wallets. In more aggressive instances, the program launches deceptive overlays or fake applications designed to trick victims into revealing their private recovery phrases, effectively granting hackers full control over their funds.
This discovery underscores the growing trend of cybercriminals pivoting toward Apple’s ecosystem. As macOS gains market share among developers and crypto enthusiasts, it is increasingly becoming a primary target for sophisticated financial phishing campaigns.
Security experts urge users to remain vigilant by verifying the source of all downloaded applications and enabling multi-factor authentication on their Telegram accounts. For those holding significant crypto assets, hardware wallets remain the safest defense against these types of session-hijacking threats.
