{
 "tag": "macos",
 "name": "macOS",
 "group": "Platforms & channels",
 "incidents": [
  {
   "slug": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "title": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "json": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Mac users with Ledger Live, Trezor Suite or desktop/extension wallets",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "macos",
    "infostealer",
    "ledger",
    "trezor",
    "clickfix",
    "google-ads",
    "youtube",
    "moonlock",
    "notnullosx"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-10",
   "closedAt": "2026-04-10",
   "updatedAt": "2026-04-10T12:00:00Z",
   "summary": "Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published."
  },
  {
   "slug": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "title": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "json": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "ethereum",
    "tron",
    "solana"
   ],
   "method": "fake-app",
   "product": "Ledger users who installed 'Ledger Live' from the Mac App Store",
   "tags": [
    "bitcoin",
    "ethereum",
    "tron",
    "solana",
    "fake-app",
    "ledger",
    "app-store",
    "macos",
    "apple",
    "seed-phrase",
    "zachxbt",
    "kucoin"
   ],
   "amountUsd": 9500000,
   "victims": 50,
   "startedAt": "2026-04-08",
   "closedAt": "2026-04-15",
   "updatedAt": "2026-04-15T12:00:00Z",
   "summary": "A fake Ledger Live app for macOS, published on Apple's App Store under the name 'Leva Heal Limited', asked users for their recovery phrase and drained about $9.5M from roughly 50 victims between 8 and 11 April 2026. Apple removed the app and terminated the developer account; KuCoin froze accounts used to launder part of the funds. Ledger's desktop app is only distributed from Ledger's own website, and no Ledger software ever asks for your recovery phrase."
  },
  {
   "slug": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "title": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "json": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The victim reported an apparent deepfake video of a crypto CEO on the call; Mandiant could not verify it forensically but notes UNC1069's known use of AI tools to edit images or video and of Gemini for tooling and research."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto and DeFi fintech staff on macOS",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "unc1069",
    "masan",
    "cryptocore",
    "deepfake",
    "zoom",
    "fake-meeting",
    "clickfix",
    "telegram",
    "calendly",
    "macos",
    "mandiant",
    "gemini",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2026-02-09",
   "closedAt": "2026-02-09",
   "updatedAt": "2026-02-09T12:00:00Z",
   "summary": "Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount."
  },
  {
   "slug": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "title": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys",
   "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "json": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "Malicious skills for the OpenClaw AI agent posed as Solana, Phantom and other crypto tools; some delivered the AMOS stealer and Solana keys were exposed in plain-text keypair files."
   },
   "chains": [
    "solana",
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "OpenClaw (ClawHub) skill users",
   "tags": [
    "solana",
    "multi-evm",
    "supply-chain",
    "openclaw",
    "clawhub",
    "ai-agent",
    "skills",
    "amos-stealer",
    "macos",
    "infostealer",
    "phantom",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-05",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet."
  },
  {
   "slug": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "title": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "json": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Kaspersky says generative AI has let BlueNoroff speed up malware development and refine its attack techniques; it describes the fake calls as replaying videos of earlier victims, not deepfakes."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Web3 and crypto executives, founders and blockchain developers",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "lazarus",
    "ghostcall",
    "ghosthire",
    "snatchcrypto",
    "fake-meeting",
    "fake-job-interview",
    "telegram",
    "github",
    "macos",
    "kaspersky",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-10-28",
   "closedAt": "2025-10-28",
   "updatedAt": "2025-10-28T12:00:00Z",
   "summary": "Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given."
  },
  {
   "slug": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "title": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "json": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Huntress says the Zoom meeting contained several deepfakes of known senior leaders of the victim's company, used to make the call look genuine before the fake 'extension' install."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Crypto foundation staff on macOS",
   "tags": [
    "multi-evm",
    "social-engineering",
    "dprk",
    "bluenoroff",
    "ta444",
    "lazarus",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "calendly",
    "macos",
    "cryptobot",
    "infostealer",
    "huntress",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1,
   "startedAt": "2025-06-11",
   "closedAt": "2025-06-18",
   "updatedAt": "2025-06-18T12:00:00Z",
   "summary": "Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen."
  }
 ],
 "changes": [
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-15",
   "title": "Apple removes the app and terminates the developer account; KuCoin freezes linked accounts.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-14",
   "title": "BleepingComputer reports about $9.5M stolen from ~50 victims, traced by ZachXBT and laundered via 150+ KuCoin deposit addresses.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "incidentTitle": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-10",
   "title": "Moonlock publishes its analysis of notnullOSX, including the module that swaps hardware-wallet apps for trojanized copies.",
   "sourceUrl": "https://moonlock.com/new-mac-stealer-notnullosx",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026"
  },
  {
   "incident": "fake-ledger-live-mac-app-store-9-5m-apr-2026",
   "incidentTitle": "Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-08",
   "title": "Victims who entered their recovery phrase into the fake app begin losing funds (losses ran 8-11 April).",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/",
   "url": "https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026"
  },
  {
   "incident": "unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026",
   "incidentTitle": "North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-02-09",
   "title": "Mandiant published its analysis, naming seven malware families including WAVESHAPER, HYPERCALL and SUGARLOADER.",
   "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering",
   "url": "https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026"
  },
  {
   "incident": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
   "incidentTitle": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-02-05",
   "title": "Bitdefender Labs published its analysis of malicious OpenClaw skills, including Solana- and Phantom-themed lures that delivered the AMOS stealer.",
   "sourceUrl": "https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap",
   "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026"
  },
  {
   "incident": "bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025",
   "incidentTitle": "Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-28",
   "title": "Kaspersky disclosed the GhostCall and GhostHire campaigns and their targets.",
   "sourceUrl": "https://www.kaspersky.co.uk/about/press-releases/kaspersky-bluenoroff-targets-executives-on-windows-and-macos-using-ai-driven-tools",
   "url": "https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-18",
   "title": "Huntress published its analysis, attributing the attack to BlueNoroff (TA444).",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  },
  {
   "incident": "bluenoroff-deepfake-zoom-crypto-foundation-jun-2025",
   "incidentTitle": "North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-06-11",
   "title": "Huntress was contacted about the intrusion on the employee's Mac.",
   "sourceUrl": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis",
   "url": "https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025"
  }
 ]
}