{
 "tag": "moonlock",
 "name": "Moonlock",
 "group": "Other",
 "incidents": [
  {
   "slug": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "title": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "json": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "bitcoin",
    "multi-evm"
   ],
   "method": "fake-app",
   "product": "Mac users with Ledger Live, Trezor Suite or desktop/extension wallets",
   "tags": [
    "bitcoin",
    "multi-evm",
    "fake-app",
    "macos",
    "infostealer",
    "ledger",
    "trezor",
    "clickfix",
    "google-ads",
    "youtube",
    "moonlock",
    "notnullosx"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-10",
   "closedAt": "2026-04-10",
   "updatedAt": "2026-04-10T12:00:00Z",
   "summary": "Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published."
  }
 ],
 "changes": [
  {
   "incident": "notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026",
   "incidentTitle": "notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-10",
   "title": "Moonlock publishes its analysis of notnullOSX, including the module that swaps hardware-wallet apps for trojanized copies.",
   "sourceUrl": "https://moonlock.com/new-mac-stealer-notnullosx",
   "url": "https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026"
  }
 ]
}