macOS Trojan Weaponizes Telegram to Drain Crypto Wallets: New SlowMist Findings Expose Threat

A newly discovered macOS malware is actively targeting cryptocurrency holders by compromising Telegram sessions and exploiting wallet security—and we're seeing this become a more sophisticated threat vector than previously understood.

Security researchers at SlowMist have identified the malware's multi-pronged attack strategy. The trojan doesn't just grab your login credentials; it's systematically hijacking Telegram sessions to access messaging accounts tied to wallet recovery operations. From there, attackers pivot toward the actual crypto assets.

The Attack Surface: From Telegram to Your Private Keys

Here's where it gets concerning for portfolio managers: the malware operates through credential theft as its entry point. Once it establishes a foothold on macOS systems, it begins intercepting authentication data for Telegram accounts. This creates a direct pathway into messaging histories, contacts, and recovery communications—areas where crypto users often coordinate wallet setups or receive seed phrases.

The second layer of the attack involves wallet decryption. The trojan actively works to decrypt existing cryptocurrency wallets stored on the infected machine. This suggests the malware includes wallet parsing capabilities, meaning it's specifically engineered for crypto asset extraction. It's not spray-and-pray malware; this is targeted crypto-focused threat activity.

Perhaps most insidious is the social engineering component. The malware deploys convincing fake applications that mimic legitimate wallet interfaces. Users, believing they're accessing their actual crypto wallet software, unknowingly enter recovery phrases or private key information directly into attacker-controlled applications. This low-tech but highly effective approach bypasses many technical security measures because the vulnerability sits between the keyboard and chair.

Why This Matters for Active Traders and Hodlers

For the crypto trading community, this represents a meaningful shift in attack sophistication. Rather than broad-based ransomware campaigns, we're seeing precision-targeted malware designed specifically to extract wallet credentials and cryptocurrency assets. The Telegram vector is particularly clever—it's the communication platform of choice for many crypto communities, making compromised accounts doubly valuable to attackers who can impersonate legitimate users within trading groups or coordination channels.

SlowMist's analysis underscores a critical gap in operational security practices. Too many crypto investors treat macOS as inherently secure, leading to lower vigilance around suspicious installations or downloaded applications. This malware exploits exactly that false confidence.