“Matryoshka” Malware: New macOS Attack Hides Inside “Russian Dolls” of Obfuscation

Matryoshka is a macOS-targeting social-engineering campaign that lures cryptocurrency users from typo-squatted sites through a Traffic Distribution System, instructs victims to paste a 'fix' command into Terminal, and installs a heavily obfuscated, in-memory stealer. The malware employs nested obfuscation and API-gated communications to evade detection, harvests browser data, and surgically tampers with or replaces wallet application components (notably Ledger Live and Trezor Suite) to exfiltrate funds while presenting fake error messages to delay discovery.