A macOS malware can bypass Telegram’s two-factor authentication and steal crypto wallets and account permissions

PANews July 18, according to FinanceFeeds, security researchers have found an information-stealing malware targeting macOS devices that is attacking crypto users. It can take over Telegram Desktop sessions, steal passwords and wallet databases, further control user accounts, and steal digital assets. Wallets and applications currently affected include software wallets such as Exodus, Atomic, Electrum, Wasabi, and Monero. The malware is able to extract sensitive information from macOS Keychain, Safari cookies, Apple Notes, Telegram Desktop, and multiple databases related to crypto wallets, including login credentials, authenticated session files, wallet data, and browser extension information.

Security analysis indicates that the danger of this attack chain is that it does not rely on a single wallet vulnerability. Instead, it chains together device intrusion, account takeover, wallet cracking, and seed phrase theft by collecting multiple types of data from the device. Among these, Telegram Desktop sessions are a key target. Attackers can copy authenticated Telegram local session data and restore the login on another Mac device, without needing a phone number, verification code, or Telegram 2FA password. This means Telegram 2FA cannot provide complete protection in this attack scenario, because the attackers are not making a new login—they are using an already trusted local session.

For crypto users, the risk expands even further. Because Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers obtain a user’s session permissions, they may impersonate the victim, read private chats, identify asset information, and even spread malicious links to contacts.