MacOS Malware Hijacks Telegram Sessions, Targets 12+ Cryptocurrency Wallets: SlowMist

According to blockchain security firm SlowMist, a macOS malware can hijack Telegram Desktop sessions and steal data from over a dozen cryptocurrency wallets, including Exodus, Atomic, Electrum, Wasabi, Monero, Ledger Live and Trezor Suite.

The malware harvests passwords and authenticated sessions from macOS Keychain, Safari cookies and wallet databases, then reuses the stolen Telegram Desktop session data to bypass two-step verification without requiring phone numbers or verification codes. SlowMist urged affected users to immediately terminate existing Telegram sessions, establish new trusted logins, reset two-step verification and transfer assets to new addresses.