macOS stealer malware replaced Ledger Live with a seed-phishing clone

Moonlock Lab reported campaigns in which macOS information-stealing malware deletes the genuine Ledger Live application and installs a near-identical fake. According to Moonlock, the fake app shows a message that Ledger Live encountered a critical error and asks for the 24-word recovery phrase for account recovery; anything entered is sent to an attacker-controlled server. BleepingComputer reports that victims of one variant then saw an “App corrupted” message, giving attackers time to drain funds.

Moonlock attributes the first working version to the Odyssey stealer by an actor known as Rodrigo, active from March 2025, and found a near-identical phishing page in the Atomic macOS Stealer (AMOS). BleepingComputer describes one AMOS campaign delivered as a DMG named JandiInstaller.dmg that bypassed Gatekeeper, and a separate PyInstaller-based sample found by Jamf Threat Labs that loaded the phishing page in a fake Ledger Live window. Moonlock says it has tracked related Ledger Live clones since August 2024, that earlier versions could only steal passwords, notes and wallet details, and that initial infection relies on social engineering such as cracked software, fake crypto tools or malicious ads.

The campaigns rely on malware already running on the Mac replacing the application; the sources do not describe a flaw in Ledger’s devices. Neither Moonlock’s report nor BleepingComputer’s article contains a statement from Ledger. BleepingComputer published its report on 22 May 2025; Moonlock’s article on its site is dated 30 May 2025.