# notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies

- Severity: High · Status: Still active (past)
- Chains: Bitcoin, Multiple EVM chains · Method: Fake wallet and trading apps
- Started: Apr 10, 2026 · Last update: Apr 10, 2026
- Who/what: Mac users with Ledger Live, Trezor Suite or desktop/extension wallets

Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published.

## Am I affected?
You may be affected if you ran a Terminal command from a website, video, ad or 'fix' instructions on your Mac, and later your Ledger Live or Trezor app asked for your recovery phrase.

## What to do now
If you typed a recovery phrase into the app, set up a new wallet with a new phrase on the hardware device and move funds. Treat the Mac as infected: back up files, reinstall macOS, and change passwords from a clean device. Reinstall Ledger or Trezor apps only from their official sites.

## How to avoid this
Never paste commands into Terminal because a website or video tells you to. Real Ledger and Trezor apps never ask for your recovery phrase on the computer. Keep only small amounts in browser-extension wallets.

## Indicators (block these, never visit them)
- Domain: wallpapermacos[.]com
- Domain: wallspaceapp[.]com

## Sources
- This new macOS stealer hand-picks its victims by wallet size (Moonlock, 2026-04-10): https://moonlock.com/new-mac-stealer-notnullosx

Full record: https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026 · JSON: https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.