macOS Malware Hijacks Telegram Sessions, Targets Crypto Wallets

MacSync is an information stealer targeting macOS users through terminal-based social engineering, prompting victims to run malicious commands themselves. Microsoft’s disclosure highlights the growing value of data stored on Macs, including cryptocurrency wallets, system keychains and cloud-service credentials. Such information can be monetized directly or used to gain deeper access to personal accounts and corporate infrastructure.

Microsoft’s latest analysis found that MacSync searches infected systems for crypto wallet data, macOS Keychain records and cloud credentials before exfiltrating the material in separate chunks. The malware also rotates its command-and-control, or C2, domains, making domain-based blocking and tracking more difficult. Chunked uploads can further reduce the chance that unusually large outbound transfers trigger conventional security monitoring.

macOS users are increasingly being targeted by information-stealing malware, with attackers often posing as Apple, Microsoft or Google update alerts to lower their guard. Reaper is particularly significant because it both creates a system backdoor and targets cryptocurrency wallets such as MetaMask and Phantom, potentially gaining access to credentials, private keys and control of assets.

A cybersecurity company recently disclosed that Reaper uses a mix of fake Apple, Microsoft and Google software updates to trick macOS users into installing it, after which it collects wallet data and steals assets. Existing reports have not disclosed the organization that discovered it, the exact disclosure date, the number of victims or the value of losses. Users should update software only through official channels.