New macOS Malware Bypasses Telegram 2FA to Steal Crypto Assets

Security researchers have identified a sophisticated information-stealing malware specifically targeting macOS users within the cryptocurrency ecosystem. This malicious software is capable of bypassing Telegram's two-factor authentication (2FA) by hijacking active desktop sessions, allowing unauthorized access to sensitive account permissions. Beyond messaging platforms, the malware systematically targets a wide array of digital wallets and local databases to extract private keys and login credentials, posing a significant threat to decentralized asset security.

Mechanism of the Attack and Compromised Platforms

The malware operates by infiltrating the Telegram Desktop application to clone authenticated session files. This technique allows attackers to mirror a user's account on a remote device without triggering standard 2FA protocols. Once the session is compromised, the attackers can monitor communications or manipulate account settings to facilitate the theft of funds. According to recent security analysis, the scope of the attack extends to several popular non-custodial wallets and software applications:

• Exodus and Atomic Wallet: Extraction of wallet databases and seed phrases.
• Electrum and Wasabi: Targeting of transaction data and private keys.
• Monero Wallet: Specialized scripts to locate and exfiltrate XMR-related data.
• Browser Extensions: Theft of data from Chrome and Brave-based crypto extensions.

Data Extraction from macOS System Components

In addition to targeting specific blockchain software, the malware performs a deep scan of the host operating system to gather auxiliary information that can be used for further exploitation. By accessing the macOS Keychain, the software can retrieve saved passwords that users often rely on to protect their local wallet files. The report indicates that the malware targets the following system directories and applications:

• Apple Notes: Scanning for plaintext recovery phrases or passwords.
• Safari Cookies: Harvesting session tokens to bypass web-based logins.
• Keychain Access: Decrypting stored system and application credentials.

Experts suggest that this multi-vector approach increases the likelihood of a total compromise of the victim's digital identity and financial holdings.

The emergence of this macOS-specific threat underscores the evolving sophistication of cyber-attacks directed at the cryptocurrency industry. As hackers move beyond simple phishing to advanced session-hijacking techniques, users are encouraged to utilize hardware security modules and avoid storing sensitive recovery information in unencrypted formats like Apple Notes. Maintaining updated software and employing a policy of least privilege on personal devices remain essential practices for mitigating the risks associated with modern information-stealing malware.