Two cybersecurity reports have revealed a dangerous scam targeting macOS users who utilize Ledger hardware wallets. Cybercriminals distribute counterfeit versions of the popular Ledger Live application through deceptive downloads, compromised websites, and phishing efforts. These fake apps mimic the legitimate Ledger Live software with high fidelity to deceive users.
The scam operates by initially behaving like the genuine application but eventually displaying fraudulent security alerts about suspicious wallet activity. Users are then tricked into entering their 24-word seed phrase as a "solution" to the fake alert. Upon entry, the seed phrase is instantly transmitted to attacker-controlled servers, allowing hackers to take full control of the victims' cryptocurrency wallets and rapidly drain their funds.
This method marks an evolution from earlier versions of the scam, which focused on gathering wallet details and passwords but didn't capture seed phrases directly. The new tactic leverages social engineering and malware, such as the Atomic macOS Stealer—detected on more than 2,800 compromised websites—to spread the fake Ledger Live apps widely.
The fraud underscores the essential security rule of never entering seed phrases into any software or website—these phrases should only be input directly into hardware devices during initial setup or recovery. Users are advised to download Ledger Live software solely from the official Ledger website and verify its authenticity through official channels.
Additionally, companies like Microsoft have taken legal and technical actions to disrupt malware operations, like the Lumma Stealer, which also target crypto wallets by harvesting sensitive information. Cooperation between international law enforcement agencies and firms is ongoing to tackle these evolving threats.
Maintaining vigilance, verifying software sources, being cautious of unexpected alerts, and regularly monitoring wallet balances on trusted block explorers are critical steps for protecting crypto assets from such sophisticated scams targeting wallet management software interfaces rather than the hardware wallets themselves.
