Cybercriminals Target macOS Users with Fake Ledger Apps to Deploy Malware

Cybercriminals are ramping up their efforts to compromise macOS users by deploying a wave of increasingly sophisticated malware campaigns targeting Ledger Live, the official application for managing Ledger cold wallets.

According to the Report, Researchers from Moonlock Lab have uncovered at least four concurrent operations where threat actors are weaponizing fake versions of Ledger Live, using advanced phishing mechanisms to deceive users and extract critical wallet credentials and recovery seed phrases.

Malicious Ledger Live Clones

The current threat landscape represents a dramatic escalation in attackers’ capabilities.

Initially, campaigns distributed malicious clones of Ledger Live that harvested data such as passwords, notes, and wallet details.

However, technical limitations had prevented the theft of actual funds. Since late 2024, attackers have refined their malware, engineering phishing interfaces designed to coax seed phrases directly from victims through highly convincing pop-ups or fake error dialogs.

Once a user submits their seed phrase, attackers gain full control over wallet assets, effectively bypassing Ledger Live’s hardware-enforced security.

A significant vector in these attacks involves social engineering: victims are lured by realistic threat warnings purportedly regarding suspicious activity or critical errors displayed by the trojanized Ledger Live app.

These interfaces mirror the look and feel of the legitimate app, often demanding a 24-word seed phrase “to restore access” or resolve “security issues.”

The harvested phrases are instantly transmitted to attacker-controlled command-and-control (C2) servers, giving criminals all the information required to drain the wallets in real time.

Technical Distinction Across Threat Actors

Researchers have tracked notable actors orchestrating these campaigns:

• Odyssey Stealer: This malware retrieves user identification data from local system paths and launches sophisticated phishing pages that request the user’s wallet seed phrase. The data is exfiltrated to hardcoded C2 endpoints using dedicated URL structures.

• Mentalpositive Stealer: While recent dark web chatter touts an “anti-Ledger” feature, technical analysis shows basic data theft capabilities browser credentials and exfiltration of local files with imminent upgrades to target Ledger Live more directly. The malware’s evolution is observable through string obfuscation and C2 infrastructure changes.
• Jamf-Identified Campaign: This operation leverages undetected DMG payloads on VirusTotal, delivering Mach-O binaries packed with PyInstaller for stealth. Attackers deploy layered data collection techniques, combining AppleScript and Python to extract system passwords, key documents, and browser data before displaying phishing interfaces over HTML iframes.
• AMOS (Atomic macOS Stealer): The AMOS campaign deploys obfuscated DMG installers leveraging terminal aliases to bypass Gatekeeper. After establishing persistence and harvesting browser and local file data, AMOS replaces the legitimate Ledger Live app with a counterfeit version, terminating the authentic process and misleading users into surrendering their seed phrases through a staged restoration process.

All observed campaigns emphasize anti-analysis features, such as VM detection routines and modular code, to evade research and automated defenses.

The surge in targeted attacks against Ledger Live on macOS highlights an evolution in both malware sophistication and the operational acumen of cybercriminals.

The technical barriers to compromising cold wallets are being systematically dismantled by social engineering, clone app deployment, and fast-evolving malware.

Threat researchers warn that dark web forums are abuzz with innovation, and subsequent campaign waves are imminent.

Users are urged to exercise heightened security hygiene:

• Never input a seed phrase into any dialog, pop-up, or website even if it mimics official branding.
• Download Ledger Live only from official sources.
• Monitor threat intelligence feeds for fresh indicators of compromise (IoCs) and remain alert to suspicious activity on their devices.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.