Hackers using fake Ledger Live app to steal seed phrases and drain crypto

Fake Ledger Live Apps Target Crypto Users on macOS

Cybercriminals are increasingly targeting cryptocurrency users, and a new threat has emerged for those using macOS. Hackers are distributing malware disguised as legitimate Ledger Live apps to steal seed phrases and drain crypto wallets. This review breaks down the details of this scam and how to protect yourself.

How the Scam Works

According to a report by cybersecurity firm Moonlock, the malware replaces the real Ledger Live app on a victim’s device. It then displays a fake pop-up message, prompting the user to enter their seed phrase. Once the user enters their seed phrase, the hackers gain access to their crypto wallet and can steal their funds.

• The attackers use clones to steal passwords, notes, and wallet details.
• They have evolved to steal seed phrases and empty wallets.

The Atomic macOS Stealer

One method used to replace the legitimate Ledger Live app is through the Atomic macOS Stealer. Moonlock reports that this stealer has been found on at least 2,800 hacked websites. Once a device is infected, the stealer:

• Steals personal data, passwords, and wallet details.
• Replaces the real Ledger Live app with a fake one.
• Displays a convincing alert about suspicious activity, prompting the user to enter their seed phrase.

The stolen seed phrase is then sent to a server controlled by the attackers, giving them access to the user’s assets within seconds.

Malware Campaign Active Since August

Moonlock has been tracking this malware campaign, which distributes malicious clones of Ledger Live, since August. They have identified at least four active campaigns and believe that the hackers are becoming more sophisticated. Threat actors are even offering malware with “anti-Ledger” features on the dark web, indicating a growing trend in targeting Ledger users.

How to Protect Yourself

To avoid falling victim to these scams, Moonlock recommends the following precautions:

• Be suspicious of any page that warns of a critical error and asks for your 24-word recovery phrase.
• Never share your seed phrase with anyone or enter it on any website, no matter how legitimate it looks.
• Only download Ledger Live from its official source.

Conclusion

The rise of fake Ledger Live apps targeting macOS users is a serious threat to crypto investors. By understanding how these scams work and taking the necessary precautions, you can protect your assets from being stolen. Always be vigilant and double-check the authenticity of any application before entering sensitive information. As reported by Moonlock, the threat landscape is constantly evolving, and staying informed is crucial for safeguarding your crypto holdings. This comes at a time when discussions around crypto regulation are becoming increasingly important to protect users.