Cybersecurity researchers at SlowMist have warned Apple users about a dangerous new macOS malware campaign capable of hijacking Telegram sessions and stealing cryptocurrency wallet data. The discovery highlights a growing cybersecurity threat facing crypto traders, blockchain developers, investors and Web3 companies that rely heavily on Telegram for communication and business operations. Security analysts believe threat actors specifically designed the malware to exploit the close relationship between messaging applications and digital asset management within the cryptocurrency industry.
The malware reportedly scans infected macOS devices for Telegram session files, authentication tokens, browser credentials and cryptocurrency wallet information stored locally on the system. Attackers can use stolen Telegram sessions to gain immediate access to private chats, trading groups, over the counter negotiations, token launch discussions and project administration channels without triggering traditional login verification systems. Such access creates serious financial and operational risks for cryptocurrency firms and individual investors alike.
Telegram session hijacking creates new risks for crypto users
Telegram remains one of the most widely used communication platforms across the cryptocurrency ecosystem. Exchanges, decentralized finance projects, venture capital firms, market makers and blockchain communities use the messaging application daily for business discussions and customer engagement. Criminal groups increasingly target Telegram sessions because a compromised account can provide access to sensitive financial information, wallet addresses and confidential project data.
SlowMist researchers warned that attackers no longer focus solely on stealing passwords or seed phrases. Modern malware campaigns now pursue session tokens and authentication files that allow criminals to bypass traditional account protection mechanisms and maintain access for extended periods. This strategy enables attackers to impersonate legitimate users, manipulate transactions and distribute malicious links to additional victims inside trusted communities.
Crypto wallets become high value targets on macOS
The latest warning reflects a broader trend involving sophisticated macOS information stealers targeting cryptocurrency assets. Security researchers have observed malware families that search for browser wallet extensions, desktop wallet applications, private keys and recovery phrases stored on Apple devices. Cybercriminals increasingly view macOS users as attractive targets because many crypto investors, developers and startup founders prefer Apple’s ecosystem for professional use.
Several recent malware campaigns have targeted popular wallets and authentication services while simultaneously harvesting browser cookies, saved passwords and cloud credentials. Once attackers collect this information, they often gain the ability to drain digital assets, compromise exchange accounts and launch further attacks against business infrastructure connected to the victim’s identity.
Security experts urge immediate protective measures
SlowMist recommends that macOS users avoid downloading software from unofficial websites and verify every application before installation. Security professionals also advise users to review active Telegram sessions regularly, remove unknown devices and store cryptocurrency recovery phrases in offline environments that remain disconnected from internet-connected machines.
Organizations operating in the blockchain industry should deploy endpoint security monitoring, enforce multi factor authentication and establish strict access management policies for internal communication channels. As cybercriminal groups continue to refine malware designed for cryptocurrency theft, proactive cybersecurity practices remain the strongest defense against financial losses and account compromise.
