Ledger Live Mac Users at Risk: Attackers Upgrade Tactics to Steal Seed Phrases and Empty Crypto Wallets

Fake Ledger Apps Target macOS Users with New Seed Phrase Theft Malware

Mac users who manage cryptocurrency through Ledger Live are facing a rising wave of malware attacks designed to steal their wallet recovery phrases and empty their accounts.

Cybersecurity experts from Moonlock have uncovered sophisticated fake versions of the Ledger Live app being pushed to unsuspecting users, tricking them into revealing their 24-word seed phrases—the master keys to their crypto assets.

How Are Hackers Replacing the Genuine Ledger Live App

The attack starts when a piece of malware called Atomic macOS Stealer infects a user’s device, often through compromised websites—Moonlock found it on at least 2,800 hacked sites.

This malware quietly swaps out the real Ledger Live application with a counterfeit one.

The fake app then displays convincing alerts, prompting users to enter their recovery phrases to resolve supposed security issues.

Source: Moonlock Lab

Moonlock explained,

“The fake app then displays a convincing alert about suspicious activity, prompting the user to enter their seed phrase. Once entered, the seed phrase is sent to an attacker-controlled server, exposing the user’s assets in seconds.”

From Stealing Details to Emptying Wallets—Tactics Escalate

Moonlock has been tracking these malicious clones since August 2024.

Initially, the fake apps could only capture wallet details and passwords, giving criminals a glimpse of the victim’s holdings but no direct access to move funds.

Over time, attackers have upgraded their tactics to focus on stealing seed phrases, which allows them to take full control and drain wallets.

Moonlock noted,

“This isn’t just a theft. It’s a high-stakes effort to outsmart one of the most trusted tools in the crypto world. And the thieves are not backing down.”

New Variants and Copycat Attacks Emerging

In March, Moonlock identified a new strain of macOS malware called ‘Odyssey,’ deployed by a hacker known as ‘Rodrigo.’

Odyssey replaced the Ledger Live app with a trojanised version that incorporated a phishing page, asking victims to enter their 24-word seed phrases after showing a fake “critical error” message.

Fake “critical error” message. (Source: Moonlock Lab)

Users being prompted to enter their 24-word seed phrases (Source: Moonlock Lab)

The effectiveness of this method inspired imitators.

Shortly after, the AMOS stealer appeared with similar features, delivering the malware via a DMG file named ‘JandiInstaller.dmg’ that bypassed Apple’s Gatekeeper security.

Victims entering their seed phrase into the AMOS clone would see a deceptive “App corrupted” alert, allowing attackers to quietly extract assets.

Another campaign discovered by Jamf used a different approach, embedding a phishing page via iframe inside a fake Ledger Live interface, targeting browser data and wallet configurations alongside seed phrase theft.

Never Enter Your Seed Phrase Online

Recovery phrases should never be entered into apps or websites.

They are meant to be kept offline and only used directly on physical Ledger devices when restoring or setting up wallets.

Moonlock urges users to avoid downloading Ledger Live from unofficial sources and to be suspicious of any app or pop-up asking for the seed phrase.

Microsoft’s Efforts Against Similar Threats

In a related move against crypto malware, Microsoft announced on 21 May it had taken down infrastructure linked to the Lumma Stealer, a malware operation responsible for stealing passwords, banking information, and crypto credentials.

The company worked with international law enforcement to seize nearly 2,300 websites linked to Lumma’s network, disrupting the sale and spread of the malware.

The Growing Threat from Dark Web Malware

Despite some malware with so-called “anti-Ledger” features being advertised on dark web forums, Moonlock’s research indicates many remain incomplete or in development.

Still, criminal groups continue to refine their tactics, escalating the threat against users relying on Ledger Live.

Moonlock warned:

“On dark web forums, chatter around anti-Ledger schemes is growing. The next wave is already taking shape. Hackers will continue to exploit the trust crypto owners place in Ledger Live.”

Staying vigilant, only using official Ledger Live downloads, and never sharing seed phrases remain critical to safeguarding crypto assets in this hostile environment.