macOS Malware Hijacks Ledger Live with “Invisible” Electron Archives

### Executive Summary Intego Antivirus Labs uncovered a macOS campaign that delivers the OSX/Amos infostealer by replacing an application's Electron ASAR archive with a weaponized version that includes malicious JavaScript. The malicious bundle disables TLS certificate validation globally (NODE_TLS_REJECT_UNAUTHORIZED = '0') to permit silent exfiltration to attacker infrastructure and injects HTML phishing overlays prompting victims to enter 12/24-word recovery phrases, enabling theft of cryptocurrency wallets.