macOS info-stealer hijacks Telegram sessions, swaps Ledger and Trezor apps
Security & Exploits ·
Security firm SlowMist reconstructed a full account-takeover chain after its MistEye monitoring system flagged a new macOS info-stealer targeting Telegram Desktop and crypto wallet data.
The malware was first spotted by MistEye's detection system, prompting SlowMist to trace what the stolen files could actually be used for, since copying data does not automatically mean an account or wallet has been compromised. Its haul spans the macOS Keychain, Safari cookies, Apple Notes, Telegram Desktop's local files, and databases tied to more than a dozen different cryptocurrency wallets, a spread that suggests the operation is casting a wide net rather than chasing one specific target, according to a writeup archiving the signal.
To test whether the theft translated into real access, SlowMist's analysts moved the extracted Telegram Desktop session files onto a separate macOS machine in a controlled setting. When the client opened, there was no login screen, no phone-number prompt, no verification code, and no request for a two-step verification password — the app simply resumed the original account and pulled in its chat history. That result showed the attacker was not just holding a settings file but a session that was already fully authenticated, letting them step directly into someone's Telegram account.
On the wallet side, the malware pairs a stolen wallet database with a list of candidate passwords for offline decryption attempts, run entirely on the attacker's own systems. Separately, it deletes the user's genuine wallet application and installs a replacement disguised with the same name and icon, a swap that has been documented hitting Ledger among the affected wallet brands, alongside Trezor. That substitute is a remote web-wrapper app designed to get the victim to type in their recovery phrase directly.
Strung together, the pieces form a five-step sequence: harvest passwords and unlocking material across the system, lift the already-authorized Telegram session, copy wallet and browser-extension databases, run offline decryption against them, and finally swap out the legitimate wallet app for the phishing loader. A separate account tracking the campaign also framed the technique as one that sidesteps two-factor authentication entirely by reusing an existing session rather than trying to defeat it, per a [post describing the mechanism](https://x.com/officer