notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies
Mac users with Ledger Live, Trezor Suite or desktop/extension wallets
Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published.
Why this severity: Still active, many people exposed.
- Started
- Apr 10, 2026
- Closed
- Apr 10, 2026
- Chains
- Bitcoin, Multiple EVM chains
Indicators · never visit or send to these
- wallpapermacos[.]com
- wallspaceapp[.]com
What to do now
- If you typed a recovery phrase into the app, set up a new wallet with a new phrase on the hardware device and move funds. Treat the Mac as infected: back up files, reinstall macOS, and change passwords from a clean device. Reinstall Ledger or Trezor apps only from their official sites.
Stay safe
Am I affected?
You may be affected if you ran a Terminal command from a website, video, ad or 'fix' instructions on your Mac, and later your Ledger Live or Trezor app asked for your recovery phrase.
What to do now
If you typed a recovery phrase into the app, set up a new wallet with a new phrase on the hardware device and move funds. Treat the Mac as infected: back up files, reinstall macOS, and change passwords from a clean device. Reinstall Ledger or Trezor apps only from their official sites.
How to avoid this
Never paste commands into Terminal because a website or video tells you to. Real Ledger and Trezor apps never ask for your recovery phrase on the computer. Keep only small amounts in browser-extension wallets.
Timeline 1
Moonlock publishes its analysis of notnullOSX, including the module that swaps hardware-wallet apps for trojanized copies.
Source
News & write-ups ›1
How this method works
Look-alike apps on app stores or download sites that steal your seed phrase or show a fake balance while keeping your deposits. Read about fake wallet and trading apps →
Follow new drains and updates in your feed reader or Telegram RSS bot.