Microsoft Discovers macOS Phishing Campaign Targeting Exodus, Ledger, and Trezor Wallets Since Late 2025

According to Microsoft's security research team, since late 2025, attackers have been distributing fake macOS troubleshooting guides on platforms including Medium, Craft, and Squarespace to trick users into running malicious terminal commands. The commands download and execute malware designed to steal cryptocurrency wallet keys from Exodus, Ledger, and Trezor, along with iCloud data and saved passwords from Chrome and Firefox.

The malware families involved include AMOS, Macsync, and SHub Stealer. In some cases, attackers also delete legitimate wallet applications and replace them with trojanized versions. Apple has added protection in macOS 26.4 to block pasting of potentially malicious commands.