The main dishes to remember:
- Pirates target macOS users with false live applications to steal seed phrases and crypto backgrounds.
- The MacOS Atomic thief is the main malware used, found on more than 2,800 compromise websites.
- Moonlock warns that attackers become more sophisticated, with multiple active campaigns in progress.
A wave of malicious software attacks targeting macOS users exploits confidence in Ledger Live, a popular Crypto portfolio management app.
According to the cybersecurity company, Moonlock, the pirates distribute false versions of the application to steal user seed sentences and drain their cryptographic operations.
In a report published on May 22, Moonlock warned that malicious actors use Ledger Live Trojanized clones to encourage users to enter their recovery sentences thanks to convincing pop-ups.
“In one year, they learned to fly seed sentences and empty their victims’ portfolios,” said the team, noting a major development of the threat.
The thief of atomic macos appears as a key tool in cryptographic flight campaigns
One of the main vectors of infection is the atomic macos thief, a tool designed to exfiltrate sensitive data such as passwords, notes and details of the cryptographic portfolio.
Moonlock discovered it integrated at least 2,800 compromise websites.
Once installed, the malware quietly replaces the Live Ledger application with a false that triggers false alerts to collect seed sentences.
At a time when a user enters their 24 -words recovery sentence in the bogus application, the information is sent to the servers controlled by the attacker.
“The false application then displays a convincing alert on the suspicious activity, encouraging the user to enter his sentence sentence,” said Moonlock.
“Once entered, the seed sentence is sent to a server controlled by the attacker, exposing the user’s assets in a few seconds.”
Moonlock has been following this type of malware since August, identifying at least four current campaigns.
While some dark web suppliers claim to offer malicious software with advanced “anti-Ledger” capacities, Moonlock has found that many of these tools are still being developed. This has not slowed down the attackers, who continue to refine their methods.
“It’s not just a flight,” said Moonlock. “It is an effort with high issues to thwart one of the most reliable tools in the world of cryptography. And thieves do not retreat. “
To stay safe, users are invited to avoid downloading applications from unofficial sources, to be skeptical about sudden contextual windows to request a seed phrase and never share their recovery sentence – no matter how authentic the interface is.
“We see malicious software campaigns targeting macOS users with false LEDGER applications designed to steal seed sentences. These malicious clones create convincing alerts on suspicious activity to encourage users to enter their recovery sentences,” said Charles Guillemet, CTO in Ledger.
“Do not forget: Ledger will never ask for your 24 -words recovery sentence via contextual windows, alerts or any other method in the application. Always download Ledger live exclusively from ledger.com, and never grasp your seed phrase unless you recover a portfolio on a real Ledger device.”
Microsoft takes legal action against Lumma Stealer’s malware
On May 21, Microsoft took legal and technical measures to disturb Lummma Stealer, a malicious software operation notorious responsible for theft of generalized information, including cryptographic portfolios.
The company revealed that a Federal Georgia court authorized its digital crime unit to enter or block nearly 2,300 websites related to Lumma infrastructure.
Working alongside the US Ministry of Justice, the European Cybercrime Center for Europol and the Japan cybercrime control center, Microsoft said that it had helped dismantle the malware command and control network and the markets where the software had been sold to cybercriminals.
Launched in 2022 and permanently upgraded, Lumma was distributed via underground forums and used to collect passwords, credit card numbers, banking identification information and digital asset data.
Post-Live Live Applications by Fawer Ledger target macOS users in the cryptocurrency malware scam appeared first on cryptonews.
