Key Takeaways
- A pretend Ledger Reside app is changing the true model on MacOS to steal customers’ seed phrases.
- Over 2,800 hacked web sites are distributing the Atomic macOS Stealer malware.
- Moonlock has tracked not less than 4 phishing campaigns since August 2024 focusing on Ledger customers.
A pretend model of Ledger Reside is focusing on MacOS customers, utilizing superior malware to silently exchange the respectable utility and steal customers’ seed phrases.
Malware distribution & operation
The malicious marketing campaign begins when customers go to one in all over 2,800 hacked web sites distributing Atomic macOS Stealer (AMOS).
As soon as put in, the malware deletes the real Ledger Reside app and installs a visually an identical pretend.
The app then shows a warning of “suspicious exercise” and prompts the person to enter their 24-word restoration phrase.
In accordance with cybersecurity agency Moonlock, as soon as entered, the phrase is transmitted to an attacker-controlled server.
Cybersecurity insights
“As soon as entered, the seed phrase is distributed to an attacker-controlled server, exposing the person’s belongings in seconds,” Moonlock said in its Could 22 report.
Ongoing monitoring & assault variants
Moonlock has been monitoring the marketing campaign since August 2024 and has linked it to not less than 4 lively assault operations.
The most recent strains, together with one known as Odyssey, show a pretend “vital error” and request the restoration phrase, then present an “App corrupted” message to delay person suspicion.
Broader phishing developments
That is a part of a broader pattern.
Different assault vectors embody phishing hyperlinks posted in Ledger’s official Discord after a moderator account was compromised, bodily letters with malicious QR codes, and Reddit scams—one in all which resulted in a $15,000 loss.
Safety suggestions
{Hardware} pockets customers are suggested by no means to enter their restoration phrase into any laptop or web site.
The phrase ought to solely ever be enter immediately into the {hardware} pockets gadget itself.