Apple

<p>Apple Mac users are no longer safe from crypto hackers. Blockchain security firm SlowMist has discovered a new malware that can steal Telegram accounts, crypto wallet data, passwords, and even recovery phrases.&nbsp;</p>
<p>The malware quietly targets macOS users and can give hackers full access to their digital assets.<br><br>Here’s the detailed report on how it was done by the hacker. So, read it to avoid getting hacked.</p>
<h2 id="h-how-the-new-mac-malware-targets-crypto-users" class="wp-block-heading">How the New Mac Malware Targets Crypto Users</h2>
<p>According to <a href="https://x.com/SlowMist_Team/status/2077357100007825540" rel="noopener noreferrer nofollow">SlowMist</a>, the newly discovered malware is designed specifically for macOS devices. Once installed, it quietly collects sensitive information stored on the computer without alerting the victim.</p>
<p>The malware can steal data, including</p>
<ul>
 <li>Telegram login sessions</li>
 <li>Saved passwords</li>
 <li>Apple Keychain data</li>
 <li>Browser credentials</li>
 <li>Notes stored on the Mac</li>
 <li>Encrypted crypto wallet databases</li>
</ul>
<p>This means anyone who stores passwords, crypto wallets, or sensitive information on a Mac could become a target.</p>
<h2 id="h-how-hackers-steal-crypto-using-this-malware" class="wp-block-heading">How Hackers Steal Crypto Using This Malware</h2>
<p>SlowMist explained that the attack happens in several steps.</p>
<ul>
 <li><strong>Step one:</strong> A victim downloads or installs a malicious file disguised as a normal application.</li>
 <li><strong>Step two:</strong> The malware secretly searches the Mac for Telegram sessions, browser passwords, Apple Keychain data, Notes, and encrypted wallet files.</li>
 <li><strong>Step three:</strong> The stolen data is sent to the attacker, who can use the Telegram session without needing a login code.</li>
 <li><strong>Step four:</strong> The malware displays fake Ledger or Trezor wallet windows that look almost identical to the real apps.</li>
 <li><strong>Step five:</strong> When users enter their recovery phrase, it is immediately sent to the attacker, giving hackers complete control of the wallet.</li>
</ul>
<h3 id="h-how-telegram-users-face-a-bigger-risk" class="wp-block-heading">How Telegram Users Face a Bigger Risk</h3>
<p>The biggest concern is coming from the Telegram session theft. Because the malware steals active Telegram sessions instead of passwords, <a href="https://coinpedia.org/news/hedera-network-suffers-5m-sauce-protocol-hack-hbar-coin-price-falls/" rel="noopener noreferrer nofollow">hackers</a> can instantly access private chats without asking for verification codes.</p>
<p>Many crypto traders use Telegram for exchange accounts, OTC deals, and private investment groups, making these accounts highly valuable targets.</p>
<h2 id="h-how-mac-users-can-stay-safe" class="wp-block-heading">How Mac Users Can Stay Safe?</h2>
<p>SlowMist recommends several steps to reduce the risk:</p>
<ul>
 <li>Download apps only from trusted sources.</li>
 <li>Never enter your recovery phrase into pop-up wallet windows.</li>
 <li>Keep recovery phrases offline.</li>
 <li>Use hardware wallets carefully and verify every wallet prompt.</li>
 <li>Update macOS and security software regularly.</li>
 <li>Log out of Telegram sessions you do not recognize.</li>
</ul>
<p>The security firm says even experienced crypto users can become victims if they trust fake wallet windows or install unknown software, making extra caution essential.</p>

SlowMist Finds Dangerous Mac Malware That Targets Crypto Users

Table of Contents

CoinPedia News

Other articles published on Jul 17, 2026

Join our free newsletter for daily crypto updates!