Blockchain security firm SlowMist has uncovered a macOS information-stealing malware capable of hijacking Telegram sessions and targeting digital currency wallets, revealing an attack chain that could grant attackers unauthorized access to accounts and digital assets.
The malware targets macOS Keychain, Safari cookies, Apple Notes, Telegram Desktop local data, and the databases of over a dozen digital currency wallets, according to SlowMist. The firm explained that the malware collects passwords and authenticated sessions in Telegram and copies the users’ authenticated Telegram Desktop session data, wallet databases, and browser wallet extension data.
After conducting an analysis in a controlled environment, SlowMist reported that the attackers would try to decrypt the stolen wallet databases offline. They may use information collected from the infected device or replace legitimate Ledger and Trezor applications with counterfeit versions. This could deceive victims into entering their recovery phrases.
SlowMist confirmed that Telegram’s two-step verification does not prevent this attack because the malware exploits an already authenticated local session instead of initiating a new login. During testing, SlowMist transferred stolen Telegram Desktop session data to another Mac and regained access to the account without being prompted for a phone number, a verification code, or a two-step verification password.
“Telegram’s Two-Step Verification primarily protects the process of authorizing a new login. When an attacker directly restores an already-authorized local session, the client does not repeat the full authentication flow involving the phone number, verification code, and Two-Step Verification password,” SlowMist explained.
“A more accurate description is that the attacker reuses an already authenticated local session, so 2FA is never triggered again. This does not mean that Telegram’s Two-Step Verification password has been cracked. Rather, the session restoration process never enters the stage where that password is required.”
The malware combines multiple techniques into a coordinated attack chain, allowing it to use different methods to compromise digital currency accounts and wallets.
The malware targeted wallets such as Exodus, Atomic, Electrum, Wasabi, and Monero, SlowMist said. In addition to hardware wallet applications such as Ledger Live and Trezor Suite, it also searches for data stored in Bitcoin Core, Litecoin Core, Dash Core, and Dogecoin Core.
SlowMist said that their findings demonstrate that modern information-stealing malware has evolved beyond collecting passwords or copying files. By combining authenticated sessions, stored credentials, wallet databases, and social engineering techniques, attackers can build a complete account takeover chain that increases the likelihood of gaining access to users’ accounts and digital assets.
SlowMist adds that compromising a device can undermine the trust users place in desktop applications, even when accounts are protected with advanced security features such as two-step verification.
The blockchain security firm urges users to keep their macOS and applications up to date, download software only from trusted sources, and regularly monitor for unauthorized changes to applications. They also stressed the importance of protecting recovery phrases.
Some of their recommendations to avoid getting attacked include:
- Immediately terminating all existing Telegram sessions from a trusted device, establishing a new trusted login, and changing both their password and two-step verification and desktop passcode.
- Generate a new recovery phrase after discovering that their account has been exposed, transfer all assets to new addresses, and stop using the old recovery phrase.
- Rotate the password stored in macOS Keychain, Apple Notes, and browsers.
- Review the login status of Telegram clients used on secondary devices, such as Telegram Desktop or Telegram for macOS.
Read the detailed report here.
Watch | Blockchain & IPv6: The Next Killer App
Be the first to comment