# macOS · Drain Watch

6 incidents, 1 live. JSON: https://drains.watch/t/macos.json · RSS: https://drains.watch/t/macos/feed.xml

- [notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies](https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026) (closed, High, Still active, since Apr 10, 2026)
- [Fake Ledger Live app on Apple's Mac App Store stole about $9.5M in seed-phrase thefts](https://drains.watch/i/fake-ledger-live-mac-app-store-9-5m-apr-2026) (closed, Critical, Partly contained, since Apr 8, 2026)
- [North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech](https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026) (closed, Medium, Still active, since Feb 9, 2026)
- [Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys](https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026) (live, High, Partly contained, since Feb 5, 2026)
- [Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks](https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025) (closed, Medium, Still active, since Oct 28, 2025)
- [North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac](https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025) (closed, Medium, Still active, since Jun 11, 2025)