Keystone on Kaspersky's analysis: macOS stealer MacSync spreads as “Toria” wallet and can replace the Ledger application
According to Kaspersky's analysis cited by Keystone, a new version of the MacSync stealer for macOS is being distributed as a crypto wallet called “Toria,” with its own website and promotion on X and Telegram, as well as in “free” and cracked builds of popular software. Once installed, it can steal the macOS login password and Keychain, browser passwords and cookies, data from wallet extensions and applications, and Telegram, SSH, AWS and Git configurations. The analysis separately notes that its backdoor can replace the installed Ledger application with a version downloaded from the attacker's server. Bitcoin owners who store or sign anything on a Mac, and developers with access keys on the same machine, are at risk.
Do not install wallets you first encounter in promotional posts, and obtain applications only from the vendor's official source. If “Toria” or a dubious build has already been installed, immediately stop using this machine for operations involving keys, transfer funds, move to an environment known to be clean, create a new seed on a hardware device and move funds to new addresses, and rotate passwords, SSH keys and API keys. Check every transaction on the hardware wallet's screen.