"Activator" Alert: MacOS Malware Hides in Cracked Apps, Targeting Crypto Wallets

Activator is an actively maintained macOS backdoor distributed through cracked software DMGs that tricks users into granting administrator privileges, then uses a novel DNS TXT-based C2 mechanism to fetch encrypted scripts and payloads; the malware can run arbitrary commands, persist, and replace crypto wallet applications (Exodus, Bitcoin Core) with trojanized versions that steal seed phrases and wallet credentials, and has been observed at scale across hundreds of infected Mach-O binaries.