Kaspersky Labs, a reputable cybersecurity company, has issued a cautionary alert regarding a new strain of malware infiltrating MacOS systems through pirated software. This malicious software replaces legitimate Bitcoin and Exodus wallets with infected versions, posing a significant threat to users' cryptocurrency security. The hackers behind this malware are actively refining their tactics, hinting at a potential large-scale attack in the future.

In December, researchers uncovered a cluster of trojan proxies designed to exploit genuine applications obtained from unofficial sources. Exploiting the vulnerability of users seeking cracked software, the hackers capitalize on their lowered guard to deceive them into installing the malware. This malware primarily targets MacOS versions 13.6 and higher, gaining access to sensitive information such as security passwords and private keys associated with crypto wallets through compromised prompts.

Concerningly, the malware's development was ongoing as researchers monitored its activities. Despite its simple methodology, the malware itself was described as remarkably sophisticated. It establishes a backdoor capable of executing scripts with administrative privileges. Subsequently, it replaces legitimate Exodus and Bitcoin wallets with compromised versions, secretly extracting recovery phrases once the user unlocks the wallet.

To safeguard against such threats, Kaspersky Labs recommends regular system updates, using reputable sources for software downloads, and maintaining robust security measures. However, the risk extends beyond pirated software, as hackers often disguise malware as genuine wallets on fraudulent websites or online marketplaces.

The FBI has issued official warnings regarding this tactic. Notably, a North Korean hacker group known as the Lazarus Group successfully deployed MacOS-targeting malware, which circulated within decentralized finance communities via Discord groups in November of last year.