Security researcher SlowMist described macOS malware that combines stolen Telegram sessions, copied wallet databases and fake wallet interfaces in a July 2026 technical report.
The important distinction is between compromising a computer and defeating a blockchain’s cryptography. The report describes attackers exploiting information and applications on an infected device.
Several routes to account theft
SlowMist’s testing showed that copied Telegram data could restore an already authenticated session. This avoids a new login rather than cracking the two-step verification password.
The malware also collected wallet databases and candidate passwords from several local sources. A separate phishing route replaced Ledger and Trezor companion applications with deceptive interfaces intended to obtain recovery phrases. The report does not establish that the hardware devices themselves were cryptographically broken.
Responding to suspected exposure
SlowMist recommended revoking Telegram sessions and changing credentials from a trusted device. Where private keys or recovery phrases may have been exposed, it recommended creating a fresh wallet on a clean device and retiring the compromised phrase.
Changing an application password alone does not revoke an exposed blockchain private key. Do not enter recovery phrases into unsolicited verification screens.
Editor’s note: The report now links directly to SlowMist’s analysis and distinguishes session reuse and phishing from password cracking or a hardware-wallet cryptographic failure.