A cybersecurity firm, Moonlock, has issued a warning about a new wave of cyberattacks targeting macOS users who manage their cryptocurrency with Ledger Live. Hackers are deploying fake versions of the Ledger Live app, using malware designed to steal users’ seed phrases and drain their wallets.
The attack starts by replacing the real Ledger Live software on the targeted device with a plausible clone. Then, through a fake pop-up alert, the malware tricks users into entering their 24-word seed phrase—the master key to their crypto wallets.
“At first, these cloned apps only stole passwords, notes, and wallet info to get a look at users’ holdings,” explained Moonlock in a report published on May 22. “But now, within a year, the hackers have stepped up their game: they’re stealing seed phrases and emptying wallets entirely.”
The malware behind this is called the Atomic macOS Stealer. Moonlock said it has found it on over 2,800 compromised websites. Once installed, it quietly snatches personal data and swaps out the legitimate Ledger Live for the fake one.
https://twitter.com/moonlock\_com/status/1924931064356577540
“The fake app then shows a convincing warning about suspicious behavior, urging users to enter their seed phrase,” Moonlock stated. “Once the seed phrase is entered, it’s sent straight to the attackers, who can then empty the victim’s crypto assets in seconds.”
This scam has been active since last August, with multiple ongoing campaigns. Moonlock warns that hackers are only getting smarter, with underground groups on dark web forums developing new anti-Ledger phishing tools.
Source: Moonlock
“This is more than just theft — it’s a battle to outsmart one of the most trusted crypto security tools,” Moonlock emphasized. “And the criminals aren’t slowing down. They’re exploiting the trust crypto users place in Ledger Live, and the next wave of attacks is already forming.”
To stay safe, Moonlock urges users to be extremely cautious if they encounter any webpage or app asking for their 24-word recovery phrase. Never share this phrase with anyone or enter it on any site—even if it looks official. Download Ledger Live exclusively from the official website.
Get the weekly commit
New blockchain deep dives every week.
