Phishing Campaign Uses Fake BlueWallet Website to Distribute Credential-Stealing Malware to macOS Users

Executive Summary

Security researchers have identified a phishing campaign specifically targeting macOS users of the BlueWallet cryptocurrency wallet. The campaign uses a fraudulent website, update-bluewallet.com, which is a convincing clone of the legitimate bluewallet.io site. Victims are tricked into downloading and executing a malicious AppleScript file. The malware does not exploit a software vulnerability but relies on user interaction. Once run, it acts as a comprehensive infostealer, exfiltrating passwords, browser data, and crypto wallets. It also includes a clipboard hijacking function to steal cryptocurrency during transactions.

Threat Overview

This is a classic social engineering attack that preys on users' intentions to keep their software updated. The threat actor has set up a typosquatted domain that looks legitimate and automatically serves a malicious file.

The attack flow is as follows:

1. A user visits the malicious site update-bluewallet.com.
2. The site automatically downloads an AppleScript file.
3. The user is prompted to open the file, which launches the macOS Script Editor.
4. If the user clicks the "Run" button, the malicious script executes.

This multi-step process requires significant user interaction, but the convincing nature of the website can easily fool unsuspecting victims.

Technical Analysis

The core of the attack is a malicious AppleScript, a scripting language for macOS. This is an example of Execution via User Execution (T1204).

Once executed, the malware performs several malicious actions:

• Credential Stealing (T1555): It accesses and exfiltrates saved passwords from browsers and the macOS Keychain.
• Data Theft: It searches for and steals documents and cryptocurrency wallet files from the user's home directory.
• Clipboard Hijacking (T1115): This is the most dangerous component. The malware continuously monitors the system clipboard. When it detects a string that matches the pattern of a cryptocurrency wallet address, it silently replaces it with a hardcoded address controlled by the attacker. When the user pastes the address to send funds, they are unknowingly sending them to the thief.

Impact Assessment

Any user who falls victim to this attack must consider their system and all associated accounts fully compromised. The immediate impact is the theft of any cryptocurrency stored in local wallets and the potential loss of funds through the clipboard hijacking. The long-term impact is more severe, as the theft of all saved browser and system passwords gives the attacker access to the victim's email, social media, banking, and other online accounts. This can lead to widespread identity theft and financial fraud.

IOCs — Directly from Articles

Cyber Observables — Hunting Hints

For individual users and security teams, hunting for this activity involves looking for signs of the initial script execution.

Detection & Response

1. Endpoint Security: Modern macOS endpoint security solutions may detect the malicious script based on its behavior or signatures. D3FEND's File Analysis and Dynamic Analysis are key here.
2. Browser Protection: Use web filtering tools that block access to known phishing and malicious domains like update-bluewallet.com.
3. Incident Response: If a user is believed to have executed the script, the machine should be immediately isolated from the network. The user must change the passwords for all their online accounts (email, banking, etc.) from a separate, clean device. All cryptocurrency should be moved to a new, secure wallet.

Mitigation

1. User Training (M1017): Educate users to only download software and updates from official websites and app stores. Teach them to be suspicious of unsolicited downloads and to manually verify domain names (bluewallet.io vs. update-bluewallet.com).
2. Verify Downloads: Before sending cryptocurrency, always double-check the destination wallet address. Verify the first few and last few characters after pasting to ensure it has not been modified by clipboard-hijacking malware.
3. Use Hardware Wallets: For storing significant amounts of cryptocurrency, use a hardware wallet. These devices keep private keys offline and transactions must be confirmed on the physical device, making them immune to this type of malware.