Fake BlueWallet Site Uses AppleScript to Steal Data From Macs
Summary
A fake BlueWallet site tricks Mac users into running an AppleScript that installs a data-stealing implant. It targets browser, wallet and other credentials, can replace copied crypto addresses, persists via LaunchAgent, and uses Telegram for command-and-control and exфl
Key points
- A fake BlueWallet download site targets Mac users with instructions to open and run an AppleScript; the article says the legitimate BlueWallet service was not compromised.
- The AppleScript runs a base64-encoded shell command that downloads a second-stage script to /tmp/.sysupd.sh and launches it silently.
- The implant targets browser and cryptocurrency wallet data, password-manager information, cloud and SSH credentials, and selected local files.
- It can prompt users for their macOS password, establish login persistence through a LaunchAgent, and replace copied Bitcoin, Ethereum, or Solana addresses with attacker-controlled ones.
- Telegram Bot API channels are used for data exfiltration and commands including shell execution, file downloads, and self-destruction.
- The article recommends treating a Mac as compromised if the script was run, changing credentials from a trusted device, and checking for the hidden script and unfamiliar LaunchAgents.
- Suggested detection signals include Script Editor running a base64-encoded shell command and a hidden script downloaded with curl and launched from /tmp.
Article Details
- Attack Vectors
- A fake BlueWallet download site at update-bluewallet[.]com prompted Mac users to download and manually run a malicious AppleScript in Script Editor.
- The AppleScript ran a base64-encoded shell command that downloaded a second-stage script from a remote host and launched it in the background.
- The implant collected browser, cryptocurrency wallet, password-manager, cloud, SSH, and local file data; it also captured the user's macOS password and replaced copied cryptocurrency addresses.
- The implant established login persistence with a LaunchAgent and used Telegram Bot API channels for command and control and data exfiltration.
- Defensive Notes
- Treat a Mac as compromised if the downloaded AppleScript was opened and run; visiting the fake page alone does not execute the attack.
- Disconnect a suspected compromised machine from the network, scan it with up-to-date security software, and change account passwords from a separate trusted device.
- Move cryptocurrency to a new wallet on a clean device, treat existing seed phrases and keys as exposed, and verify destination addresses character by character before sending funds.
- Check ~/Library/LaunchAgents for unfamiliar files and /tmp for .sysupd.sh; rotate cloud and SSH credentials if relevant files were present.
- When cleanup is uncertain, back up data and reinstall macOS from a known-good source.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | projects2026box[.]com | Remote host identified as serving the second-stage malicious script. |
| DOMAIN | update-bluewallet[.]com | Fake BlueWallet download site used to lure Mac users into downloading the malicious AppleScript. |
| SHA256 | 216277bdb7998b48852024fc8b5853c3dc50b3857fd22afd1320b884bcaa0a61 | SHA-256 hash identified in the article for the malicious BlueWallet Installer.applescript. |
| URL | hxxps[:]//projects2026box[.]com/serve_site/confighelper_0adfeee8.sh | Specific payload URL used by the AppleScript to download the second-stage script. |
MITRE ATT&CK
T1005 · Data from Local SystemThe implant collected browser data, wallet data, credentials, notes, and selected documents from the compromised Mac.T1027 · Obfuscated Files or InformationThe implant used base64 encoding and XOR-decoded configuration values, including Telegram-related settings.T1029 · Scheduled TransferThe malware split larger archives into 49 MB chunks before uploading them through Telegram.T1036 · MasqueradingThe lure used BlueWallet branding, and the second-stage file was named .sysupd.sh to resemble a system update.T1053.005 · Scheduled TaskThe article reports that the implant loaded its LaunchAgent with launchctl so it would run again at login.T1056.001 · KeyloggingA dialog posing as System Preferences prompted for the user's password and checked attempts before saving a valid credential.T1059.002 · AppleScriptThe malicious AppleScript acted as the first-stage downloader and execution vehicle.T1059.004 · Unix ShellThe AppleScript ran a base64-encoded shell command that fetched and launched the second-stage script.T1074.001 · Local Data StagingThe malware staged collected data in archives before sending it through Telegram.T1105 · Ingress Tool TransferThe first stage downloaded the second-stage script from the remote host to /tmp/.sysupd.sh.T1115 · Clipboard DataA background routine monitored the clipboard and replaced copied Bitcoin, Ethereum, or Solana addresses with attacker-controlled addresses.T1204.002 · Malicious FileThe victim had to open the downloaded AppleScript and press Run in Script Editor for the malware to execute.T1547.001 · Registry Run Keys / Startup FolderThe implant wrote a LaunchAgent plist under ~/Library/LaunchAgents to persist across logins.
Vendors
Products
BlueWalletA fake BlueWallet site at update-bluewallet[.]com impersonates the real Bitcoin wallet to trick Mac users into downloading and manually running an AppleScript that installs a credential-stealing implant.macOS[T1074.001] Local Data Staging: Local Data Staging – The malware staged stolen data into archives before exfiltration (‘archives the staged data with macOS’s own ditto’).Script EditorThe campaign relied on social engineering, urging victims to open a downloaded AppleScript in Script Editor and press Run.Telegram Bot APICommand-and-control and exfiltration were handled through Telegram Bot API channels, with support for commands like /info, /exec, /download, and /selfdestruct.