macOS Wallet Stealer Uncovered: “Nova” Malware Replaces Ledger/Trezor Apps with Phishing Clones for Seed Theft

A new macOS stealer campaign, internally dubbed “Nova” by researchers, has been uncovered, revealing a modular malware ecosystem that exfiltrates cryptocurrency wallets and silently replaces Ledger and Trezor apps with phishing clones for seed theft.

According to Bruce, the attack begins with an unknown dropper that runs a malicious installer script named mdriversinstall[.]sh and registers a LaunchAgent under a user-writable domain, then establishes persistence and a modular orchestrator that fetches Base64-encoded scripts from a C2 server.

The C2 currently serves four modules, including mdriversfiles[.]sh for crypto wallet exfiltration of Ledger Live’s app.json and Trezor/Exodus files, and mdriversswaps[.]sh which deletes legitimate wallet apps and downloads attacker-controlled replacements to harvest seed phrases. The phishing replacements load a WebKit-based UI with BIP-39 and SLIP-39 wordlists, auto-validation, and telemetry to track keystrokes, mouse activity, and page interactions in near real time.

Despite its modular design, experts note the threat’s stealth is limited by artefacts on disk, yet its ability to substitute trusted wallet apps makes it especially dangerous for cryptocurrency holders.