Cybercriminals Exploit Fake Ledger Live Apps to Target macOS Users' Crypto

According to Cointelegraph, cybercriminals are deploying fake Ledger Live applications to compromise macOS users' cryptocurrency holdings through malware designed to steal seed phrases. A cybersecurity firm, Moonlock, reported on May 22 that the malware replaces the authentic Ledger Live app on victims' devices, prompting users to enter their seed phrases via a deceptive pop-up message. Initially, attackers utilized the cloned app to access passwords, notes, and wallet details, gaining insight into the wallet's assets without the ability to extract funds. However, within a year, they have advanced their techniques to steal seed phrases and deplete victims' wallets. One method employed by scammers involves the Atomic macOS Stealer, a tool crafted to pilfer sensitive data. Moonlock has identified this stealer on at least 2,800 compromised websites. Once a device is infected, Atomic macOS Stealer captures personal data, passwords, notes, and wallet details, replacing the legitimate Ledger Live app with a counterfeit version. The fake app then issues a convincing alert about suspicious activity, urging users to input their seed phrases. Once entered, the seed phrase is transmitted to a server controlled by the attackers, exposing the user's assets almost instantly. Moonlock has been monitoring this malware campaign, which has been active since August, noting at least four ongoing campaigns. The firm believes hackers are becoming increasingly sophisticated. On the dark web, threat actors are marketing malware with "anti-Ledger" features. However, Moonlock observed that one example lacked the complete anti-Ledger phishing functionality advertised, suggesting these features might still be under development or forthcoming in future updates. Moonlock warns that this is not merely theft but a calculated effort to outsmart one of the most trusted tools in the cryptocurrency world. Discussions around anti-Ledger schemes are intensifying on dark web forums, indicating that the next wave of attacks is already forming. Hackers are expected to continue exploiting the trust that cryptocurrency owners place in Ledger Live. To protect against such malware scams, Moonlock advises users to be cautious of any page that warns of a critical error and requests a 24-word recovery phrase. Users should never share their seed phrases with anyone or enter them on any website, regardless of its legitimacy, and should only download Ledger Live from its official source. Ledger has not yet responded to Cointelegraph's request for comment.