Trust Exploited: Unpacking the macOS Malware Attacking Ledger Wallets

Daily Security Review

A growing cyber threat is targeting macOS users who rely on Ledger cold wallets to secure their cryptocurrency. In this episode, we dissect the anti-Ledger malware campaign—an increasingly sophisticated phishing operation that impersonates the trusted Ledger Live application to trick users into revealing their 24-word recovery phrases. Once entered, these phrases give attackers full access to empty the victims’ wallets.

We examine how this threat evolved from simple data-stealing to focused seed phrase phishing. From the "Odyssey" stealer introduced by the threat actor Rodrigo to the infamous Atomic macOS Stealer (AMOS), this malware ecosystem now includes advanced evasion tactics, realistic UI clones, and deceptive error messages designed to lure users into handing over their credentials.

We also discuss the techniques these malware variants use—such as fake DMG installers, malvertising, Terminal-based execution bypasses, and phishing overlays—and highlight how cybercriminals are exploiting trust in cold wallet systems to bypass traditional defenses. Plus, we spotlight emerging threats like "mentalpositive" and the dark web chatter about an evolving anti-Ledger market.

Whether you're a crypto enthusiast or just concerned about digital hygiene, this episode offers critical insight and actionable advice to help you avoid becoming the next victim of this dangerous campaign.