The cybersecurity world delivered a series of alarming signals for cryptocurrency holders this week. From sophisticated macOS malware to large-scale phishing campaigns on GitHub, attackers continue to refine their methods, targeting the most valuable assets: private keys and seed phrases.
macOS Malware: Stealing Telegram Sessions and Spoofing Hardware Wallets
My attention was drawn to an analysis of a new macOS infostealer that demonstrates a frightening level of sophistication. The malware doesn't just steal data; it uses a comprehensive approach: intercepting authorized Telegram Desktop sessions, allowing hackers to bypass two-factor authentication (2FA). The system perceives the intrusion as a continuation of an already authorized session, making this vector virtually undetectable.
Even more dangerous is the tactic of replacing legitimate applications for managing hardware wallets (Ledger Live, Trezor Suite) with exact copies. The sole purpose is to extract the seed phrase. The virus also extracts passwords from macOS Keychain, cookies from Safari, and databases from over a dozen crypto wallets, including Exodus, Atomic, Electrum, and Monero. I recommend all macOS users immediately check active Telegram sessions and forcefully terminate any suspicious connections.
Scattered Spider on Trial: Sentencing for Hacking London Transport
Two key members of the Scattered Spider group, Talha Jubair and Owen Flowers, received real prison sentences of five and a half years. Their attack on the IT infrastructure of Transport for London (TfL) in August 2024 became the largest cybercrime in UK history. The damage from the hack, which disabled 148 internal systems, amounted to £29 million, with potential economic losses estimated by authorities at up to £56 billion.
This case is a powerful signal for anyone who considers cyberattacks to be without consequences. The group is responsible not only for hacking retail chains and extorting over $115 million in a year but also for preparing attacks on medical institutions in the US. Scattered Spider has been recognized as "the most serious cyber threat to the UK," highlighting the global nature of modern cybercriminal syndicates.
300 Fake Repositories on GitHub: The BoryptGrab Trojan
Hackers deployed an entire network of 292 fake repositories on GitHub, masquerading as antivirus software, developer utilities, and cryptocurrency services. Each repository led to a phishing landing page that dynamically adapted to the brand the victim was searching for. Inside a ZIP archive, updated every minute to evade antivirus software, was the BoryptGrab trojan.
The particular danger of this stealer is that it operates exclusively in RAM, leaving no traces on the disk. It steals data from 19 browsers, 32 crypto wallets, local Telegram sessions, Steam, and Discord tokens. Given that GitHub administrators have already removed most of the fraudulent repositories, I recommend exercising extreme caution when downloading files from the platform, especially if they offer "unique" or "free" utilities.
OkoBot: A New Framework for Stealing Seed Phrases from Hardware Wallets
Kaspersky Lab has identified the OkoBot framework, which attacks owners of Ledger and Trezor hardware wallets. Its SeedHunter module operates cunningly: it injects malicious code directly into the processes of legitimate Ledger Live and Trezor Suite applications. As soon as the user connects the hardware wallet to the PC, SeedHunter blocks the interface and displays a fake window for entering the seed phrase, with the request originating from within the official program.
This method is far more dangerous than simple software substitution, as the victim is confident they are interacting with a trusted application. OkoBot also contains keyloggers and hidden screen recordings, capturing password entries and wallet openings. Infections have been recorded in 25 countries, with the attackers' servers not attacking IPs from Russia and the CIS, and comments in Russian found in the code.
Analysis of 85 Browser Wallets: Systemic Privacy Issues
Researchers from KU Leuven conducted an audit of 85 popular browser-based crypto wallets and identified systemic privacy issues. It turned out that the architecture of many wallets allows third-party trackers to link user addresses, track their movements, and even de-anonymize their identity. 36 out of 85 wallets revealed their presence to websites, creating a digital fingerprint, while 17 transmitted data allowing different addresses to be combined into a single profile.
Most alarming is the developers' response: MetaMask called the problem a "known nuance," Rabby denies the vulnerability, and OKX acknowledged the technical correctness but closed the ticket. Only Coinbase Wallet, Coin98, and Hana Wallet implemented fixes. This underscores that security in Web3 is not just about protection from hacks but also about combating features that are legal yet dangerous for privacy.
Expert Opinion
The cyber threat market is evolving from simple stealers to complex, multi-stage attacks aimed at bypassing 2FA and exploiting trusted applications. Cryptocurrency owners need to reconsider their security model: hardware wallets are not a panacea if malware intercepts control at the OS or browser level. Regularly checking active sessions, using isolated profiles for crypto assets, and manually cleaning lists of connected sites are not recommendations but mandatory precautions in the current threat landscape.