Hackers Pair Stolen Wallet Databases With Keychain Passwords for Offline Crypto Theft

A macOS-targeting infostealer campaign collects encrypted wallet databases, Keychain entries, browser passwords, Apple Notes, and Telegram Desktop session files to enable offline cracking of cryptocurrency wallets and direct account takeover. Researchers demonstrated that stolen LevelDB wallet data combined with harvested passwords or Keychain secrets can decrypt wallets off-device; attackers also deploy fake Ledger/Trezor apps (WebView loaders) to phish recovery phrases. The report includes observed IOCs and reproduction steps showing active threat behavior and practical exploitation paths for crypto theft and session reuse.