Ledger Live

Reported Context (6)

Armory, Atomic, Binance, Bitcoin Core, Coinomi, Daedalus, DashCore, ElectronCash, Electrum, Electrum-LTC, Ethereum, Exodus, Gleec, Guarda, JAXX New Version, Ledger Live, Neon, Ripple, Sparrow, Wasabi PhantomPolia Campaign Uses ClickFix and Donut Shellcode to Deliver Remus Stealer
as the second payload. After creating a Run key named Ledger Wallet Installer, it searched for Ledger Live and Ledger Wallet installations. It hid its bot ID as sixteen hex characters in a file called Google Docs Sidebar Delivers Different Malware to Mac and Windows Users
Finally, MacSync Stealer attempts to download three additional payloads if the applications Ledger Wallet, Ledger Live, and Trezor Suite respectively are present on the affected system from the following URLs: MacSync Stealer Campaign Uses Malvertising and Shared Claude Chats to Target Mac Users
app.asar files across five specific desktop wallets, including Exodus, Atomic Wallet, Ledger Wallet, Ledger Live, and Trezor Suite. macOS ClickFix Campaign Deploys AppleScript Stealer and Persistent RAT
URL with a primary and fallback; the password-protected 7z payload downloads from C2; a separate Ledger Live module is fetched from a distinct URL (not recovered – the dead-drop had been wiped by the time of Fake OpenClaw Installers Deliver Rust Malware Targeting Crypto Wallets and Password Managers

Malware (9)

People (3)

MITRE ATT&CK (44)

Vendors (8)

Products (35)

Tools (8)

Industries (4)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.