Bitcoin Wallets Face Risks From Malware and SIM Swapping Attacks

• A fake CleanMyMac utility is being used to install SHub infostealer malware on macOS devices, targeting cryptocurrency wallets and sensitive data.
• Criminals are exploiting SIM swapping scams to intercept two-factor authentication codes and gain access to bank accounts and crypto wallets.
• These attacks highlight the need for stronger authentication methods, including software-based multi-factor authentication or FIDO2 protocols.

A cybersecurity campaign has been uncovered using a deceptive macOS utility to install SHub malware, which steals private keys and login credentials. The malware is distributed through a spoofed website that mimics the CleanMyMac brand. Once installed, SHub accesses the macOS Keychain and Wi-Fi credentials, systematically extracting sensitive information including cryptocurrency wallet data.

Separately, an incident highlighted the growing threat of SIM swapping. In this attack, criminals took control of a victim's phone number to intercept SMS-based 2FA codes and gain unauthorized access to banking and crypto accounts. The victim lost money from her accounts and had her stocks sold without her knowledge.

The combination of these attacks demonstrates the increasing sophistication of cyber threats targeting cryptocurrency holders. While malware-based attacks rely on user deception to install malicious software, SIM swapping exploits weaknesses in SMS-based 2FA. Both pose substantial risks to crypto holders who rely on basic authentication methods.

How Are Malware and SIM Swapping Campaigns Exploited?

The SHub malware campaign leverages a deceptive website to trick users into executing terminal commands that install malicious software. Once installed, the malware requests the macOS password to access sensitive data. It replaces legitimate crypto wallet apps with malicious versions, maintaining control until the malicious components are removed.

In the SIM swapping case, attackers manipulate phone carriers into transferring a victim's phone number to a new SIM card. With control of the number, they can intercept one-time passwords used for account verification and gain access to accounts without the user's knowledge.

What Are the Implications for Crypto Investors and Users?

Both attacks underscore the importance of using strong authentication methods. Software-based multi-factor authentication (MFA) or hardware-based solutions like FIDO2 tokens offer greater security than SMS-based 2FA. Investors should also monitor their accounts for unusual activity and avoid executing terminal commands from unverified sources.

Investors using crypto wallets and trading platforms should remain vigilant about suspicious account activity and ensure that their authentication methods are robust. Regularly updating software and using trusted sources for app installations can reduce the risk of malware infections.

What Steps Can Users Take to Mitigate Risks?

Users are advised to avoid downloading software from untrusted websites or clicking on suspicious links. For 2FA, alternatives to SMS-based verification—such as app-based authenticators like Google Authenticator or hardware tokens—are recommended.

Additionally, users should consider enabling account alerts or monitoring tools that notify them of suspicious activity on their accounts. In the case of SIM swapping, notifying the phone carrier of any unexpected service disruptions or requests for SIM card changes can help prevent unauthorized access.

Ultimately, both malware campaigns and SIM swapping attacks emphasize the need for a layered security approach. Staying informed about evolving cyber threats and adopting best practices can help reduce the risk of falling victim to these increasingly common attacks.