MacOS Malware Hijacks Telegram, Targets Crypto Wallets: New Threat to Digital Asset Investors

Blockchain security firm SlowMist has identified a macOS malware that specifically targets cryptocurrency investors by hijacking their Telegram sessions. The malware is designed to steal login credentials, allowing attackers to take over active Telegram accounts. Once inside, the malware can decrypt cryptocurrency wallets stored on the device or trick users into revealing their wallet recovery phrases through counterfeit applications that mimic legitimate software.

The attack vector is particularly dangerous for investors who use Telegram for trading signals, group chats, or automated trading bots. By hijacking the session, attackers can impersonate the victim, execute trades, or drain wallets directly. The malware’s ability to decrypt wallets suggests that it may also extract private keys or seed phrases stored on the system, bypassing standard security measures.

SlowMist has not disclosed the specific distribution method, but the malware likely spreads through phishing links, fake downloads, or compromised software updates. The research highlights a growing trend of macOS-focused threats, as cybercriminals increasingly target the Apple ecosystem, which was once considered more secure. Investors who manage substantial crypto portfolios on Mac devices are at heightened risk.

For cryptocurrency investors, this development underscores the need to separate high-value wallets from everyday communication tools. Telegram sessions, often used for real-time market updates and peer-to-peer trading, have become a prime target. The malware’s ability to trick users into entering recovery phrases through fake apps means that even hardware wallet users could be compromised if they interact with the malicious software on their Mac.

The financial impact could be severe, especially for active traders who maintain large balances in hot wallets. Side hustles involving crypto arbitrage, airdrop farming, or Telegram-based trading bots are particularly vulnerable because they rely on continuous session access. Investors should also be wary of unsolicited download links or requests to install new software for crypto-related purposes.

As the crypto industry matures, security researchers expect more sophisticated malware strains to emerge. The SlowMist report serves as a reminder that the weakest link in digital asset security is often the user’s device and communication channel, not the blockchain itself. Mac users who engage in crypto trading should adopt multi-factor authentication, keep software updated, and avoid storing sensitive information on devices used for instant messaging.