{
 "slug": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
 "title": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
 "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
 "json": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "bitcoin",
  "multi-evm"
 ],
 "method": "fake-app",
 "product": "Mac users with Ledger Live, Trezor Suite or desktop/extension wallets",
 "tags": [
  "bitcoin",
  "multi-evm",
  "fake-app",
  "macos",
  "infostealer",
  "ledger",
  "trezor",
  "clickfix",
  "google-ads",
  "youtube",
  "moonlock",
  "notnullosx"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-04-10",
 "closedAt": "2026-04-10",
 "updatedAt": "2026-04-10T12:00:00Z",
 "summary": "Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published.",
 "timeline": [
  {
   "date": "2026-04-10",
   "title": "Moonlock publishes its analysis of notnullOSX, including the module that swaps hardware-wallet apps for trojanized copies.",
   "sourceUrl": "https://moonlock.com/new-mac-stealer-notnullosx"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "This new macOS stealer hand-picks its victims by wallet size",
   "url": "https://moonlock.com/new-mac-stealer-notnullosx",
   "publisher": "Moonlock",
   "date": "2026-04-10"
  }
 ],
 "indicators": {
  "domains": [
   "wallpapermacos[.]com",
   "wallspaceapp[.]com"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be affected if you ran a Terminal command from a website, video, ad or 'fix' instructions on your Mac, and later your Ledger Live or Trezor app asked for your recovery phrase.\n\n## What to do now\nIf you typed a recovery phrase into the app, set up a new wallet with a new phrase on the hardware device and move funds. Treat the Mac as infected: back up files, reinstall macOS, and change passwords from a clean device. Reinstall Ledger or Trezor apps only from their official sites.\n\n## How to avoid this\nNever paste commands into Terminal because a website or video tells you to. Real Ledger and Trezor apps never ask for your recovery phrase on the computer. Keep only small amounts in browser-extension wallets.",
 "notes": null,
 "agentBrief": "# notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies\n\n- Severity: High · Status: Still active (past)\n- Chains: Bitcoin, Multiple EVM chains · Method: Fake wallet and trading apps\n- Started: Apr 10, 2026 · Last update: Apr 10, 2026\n- Who/what: Mac users with Ledger Live, Trezor Suite or desktop/extension wallets\n\nMoonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published.\n\n## Am I affected?\nYou may be affected if you ran a Terminal command from a website, video, ad or 'fix' instructions on your Mac, and later your Ledger Live or Trezor app asked for your recovery phrase.\n\n## What to do now\nIf you typed a recovery phrase into the app, set up a new wallet with a new phrase on the hardware device and move funds. Treat the Mac as infected: back up files, reinstall macOS, and change passwords from a clean device. Reinstall Ledger or Trezor apps only from their official sites.\n\n## How to avoid this\nNever paste commands into Terminal because a website or video tells you to. Real Ledger and Trezor apps never ask for your recovery phrase on the computer. Keep only small amounts in browser-extension wallets.\n\n## Indicators (block these, never visit them)\n- Domain: wallpapermacos[.]com\n- Domain: wallspaceapp[.]com\n\n## Sources\n- This new macOS stealer hand-picks its victims by wallet size (Moonlock, 2026-04-10): https://moonlock.com/new-mac-stealer-notnullosx\n\nFull record: https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026 · JSON: https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}