SlowMist has uncovered a macOS information-stealing malware that can hijack Telegram sessions, collect credentials, steal cryptocurrency wallet data, and replace legitimate Ledger and Trezor applications with phishing-capable web wrappers.
Detected by SlowMist’s MistEye monitoring platform, the malware appears designed for broad data theft rather than a single targeted objective.
It searches macOS Keychain data, Safari cookies, Apple Notes, browser credentials, Telegram Desktop files, and local data from 161616 cryptocurrency wallet applications. Its danger lies in how it combines these artifacts into paths for account takeover and digital-asset theft.
The malware displays a fake macOS administrator password prompt that masquerades as a “GAPI_Update” request.
It then verifies the submitted password with the dscl utility, allowing operators to distinguish a genuine local login password from arbitrary input.
It also attempts to retrieve Chrome Safe Storage secrets from the macOS Keychain, which can help decrypt browser login data and cookies.
Targets include Chrome, Brave, Edge, Opera, Vivaldi, and Firefox. The malware collects browser databases containing saved logins, cookies, web data, form history, and extension storage.
It also steals login.keychain-db and Apple Notes databases, potentially exposing passwords, recovery phrases, Telegram passcodes, and recovery codes if victims stored them locally.
Infostealer Hijacks Telegram Wallets
The stealer specifically targets Telegram Desktop’s tdata directory, located under ~/Library/Application Support/Telegram Desktop/.
It copies files linked to local encryption keys, session state, and data mappings, including key_datas, session files, and maps data.
SlowMist restored stolen files in an isolated test environment running macOS 12.712.712.7 and Telegram Desktop 4.164.164.16.
When the Telegram client launched, it immediately restored the victim’s account. It synchronized the chat history without requesting a phone number, an SMS code, or the Telegram Two-Step Verification password.
The finding does not mean the malware cracks Telegram passwords or bypasses two-factor authentication. Instead, it reuses an already-authorized local session.
Since authentication has already occurred on the victim’s Mac, restoring the session bypasses the normal authorization flow in which Telegram would request credentials.
SlowMist also found that stolen data may be convertible into a programmable Telegram API session using available tooling and an existing authorization key.
This could permit automated access to messages and chat history, as well as message sending. At the same time, short and intermittent connections may make detection harder, medium said.
The native Telegram for macOS client was also susceptible to local-session restoration during testing. Even where server-side behavior restricted real-time messaging, cached historical chats could remain viewable inside the replicated client.
Indicators of Compromise
| Type | Indicator | Notes |
|---|---|---|
| IP address | 192[.]253[.]248[.]181 | Hosted malicious wallet-replacement ZIP archives |
| IP address | 86[.]54[.]25[.]213 | Hosted Ledger/Trezor phishing routes and logging endpoint |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
