Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
macOS Infostealer Steals Telegram Sessions and Replaces Ledger and Trezor Wallet Apps
Excerpt
SlowMist has uncovered a macOS information-stealing malware that can hijack Telegram sessions, collect credentials, steal cryptocurrency wallet data, and replace legitimate Ledger and Trezor applications with phishing-capable web wrappers. Detected by SlowMist’s MistEye monitoring platform, the malware appears designed for broad data theft rather than a single targeted objective. It searches macOS Keychain data , Safari cookies, Apple Notes, browser credentials, Telegram…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 192.253.248.181 | High | Score 86/100 | First seen |
| IP | 86.54.25.213 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…