I noticed an important warning from security experts — there's a wave of phishing targeting macOS users. The essence is that emails supposedly about audits or token unlocks are actually phishing attacks.

How does it work? Malicious actors send attachments with clever names — for example, a file looks like a .docx, but in reality, it's a .docx.scpt. The double extension is misleading, and people run the script thinking they're opening a regular document.

After launching, problems begin. The script steals system passwords, bypasses TCC protection (which is the permission system in macOS), and installs a backdoor on Node.js. As a result, attackers gain access to the system and can do anything.

SlowMist and Chainbase analyzed this phishing campaign and issued recommendations. If you accidentally opened such an email or entered your password — act immediately. Disconnect from the internet, check your system for compromise, change your passwords.

Be more cautious with verification and unlock emails. If something looks suspicious — it's better to verify directly with the source than risk your system.