Apr 10, 2026
1 new drain.
New
-
High✕Still active
notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies
Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published.
Mac users with Ledger Live, Trezor Suite or desktop/extension wallets·Bitcoin, Multiple EVM chains·Since Apr 10, 2026·