Loading malware…
notnullOSX is a modular macOS malware family written in Go that emerged in early 2026 and is primarily focused on stealing cryptocurrency and related high-value data from Apple users. It is associated with the threat actor aliases 0xFFF and alh1mik and has been described as a selective operation that prioritizes victims with substantial digital-asset holdings, particularly cryptocurrency wallets valued above $10,000. Observed targeting has included victims in Taiwan, Vietnam, and Spain.
The malware is distributed through social-engineering-heavy infection chains, most notably ClickFix-style lures that trick users into pasting commands into Terminal, as well as malicious DMG installers masquerading as legitimate macOS software such as a wallpaper application. The installation flow removes macOS quarantine protections, establishes persistence via LaunchAgent mechanisms, and guides victims into granting Full Disk Access, allowing the malware to bypass normal Transparency, Consent, and Control restrictions and access protected user data without further prompts.
notnullOSX uses a modular architecture to collect a broad range of information. Reported modules steal Messages data, Apple Notes content, Safari cookies and history, browser credentials, Telegram session data, cryptocurrency wallet files, SSH keys, cloud credentials, package-manager tokens, and other developer secrets. A notable module, ReplaceApp, replaces legitimate wallet-management applications such as Ledger Live or Trezor software with trojanized lookalikes that preserve expected branding while capturing seed phrases during wallet setup or recovery. The malware also maintains persistent command-and-control communications and can receive follow-on instructions, giving it operational characteristics beyond a simple smash-and-grab stealer.
The family is notable within the macOS threat landscape for combining targeted victim selection, credential and wallet theft, persistence, and wallet-application replacement in a single campaign. Its emphasis on cryptocurrency holders and its use of convincing macOS-specific social engineering reflect the increasing maturity of financially motivated malware targeting Apple systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Attacks with the nascent notnullOSX malware for macOS have been targeting cryptocurrency wallets containing over $10,000 in Taiwan, Vietnam, and Spain as part of a ClickFix campaign identified on Mar. 30... Multiple modules are then deployed by notnullOSX, the most concerning of which is ReplaceApp, which replaces the Trezor or Ledger Live hardware wallets with counterfeit iterations to facilitate real-time exfiltration of secret seed phrases.
Attacks with the nascent notnullOSX malware for macOS have been targeting cryptocurrency wallets containing over $10,000 in Taiwan, Vietnam, and Spain as part of a ClickFix campaign identified on Mar. 30... Multiple modules are then deployed by notnullOSX, the most concerning of which is ReplaceApp, which replaces the Trezor or Ledger Live hardware wallets with counterfeit iterations to facilitate real-time exfiltration of secret seed phrases.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Traffic to the malicious site was driven by a hijacked YouTube channel registered back in 2015 that had accumulated 50,000 views within two weeks of posting a single video.
Campaigns were using the applescript:// URL scheme to open Script Editor directly from the browser, never touching Terminal... then running curl | zsh through Script Editor’s do shell script.
The base64-encoded command shown to the victim decodes into a curl command that fetches a bash installer script from a remote server.
One path, called ClickFix, presents a Terminal command that, when pasted and run, silently downloads and installs the malware.
The second delivers a malicious DMG disk image containing a README, an install script, and a Terminal shortcut, packaged to look entirely routine.
The command presented by notnullOSX lures is base64-encoded ... Install.sh itself does not look like a script. At 299 KB, it presents a base64-encoded text.
The second path uses a fake disk image file called WallSpace.app, disguised as a legitimate macOS live wallpaper application.
Before a victim is approached, operators manually fill out a submission form identifying the target’s wallet address, social media profiles, and wallet balance. The panel documentation explicitly states the minimum threshold is $10,000, and submissions below that amount are simply not processed.
This allows hackers to steal secret seed phrases as the user types them.
Once installed, notnullOSX operates silently and persistently, extracting data from iMessages, Apple Notes, Safari cookies, browser passwords, Telegram sessions, and a wide range of cryptocurrency wallets.
A developer-focused module sweeps SSH keys, cloud credentials, and package manager tokens... The malware sweeping through these environments specifically targeted GitHub auth tokens, AWS/Azure/GCP credentials, SSH keys...
Dynamic analysis reveals the following confirmed modules executing in sequence: SystemInfo ...
Before a victim is approached, operators manually fill out a submission form identifying the target’s wallet address, social media profiles, and wallet balance. The panel documentation explicitly states the minimum threshold is $10,000, and submissions below that amount are simply not processed.
The implant also maintains a live connection back to the attacker’s server, meaning operators can send fresh instructions to infected machines long after the initial compromise.
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Go-based macOS stealer with persistence and live C2 control that targets high-value crypto victims, steals broad local and developer credentials, and can replace wallet apps with trojanized copies.
A Go-written macOS stealer delivered via social engineering, fake Google documents, a fake WallSpace wallpaper app, and a hijacked YouTube channel. It steals iMessages, Apple Notes, Safari cookies, browser passwords, Telegram sessions, and cryptocurrency wallet data, and includes a ReplaceApp module that swaps legitimate wallet apps such as Ledger Live with malicious clones to capture seed phrases. It also establishes persistence via LaunchAgent and maintains live C2 connectivity.
A macOS malware used in a ClickFix campaign to target high-value cryptocurrency wallets. It is downloaded after victims are lured into executing a command in Terminal, gains total disk access, deploys multiple modules, and can replace Trezor or Ledger Live wallet applications with counterfeit versions to steal seed phrases in real time.
A targeted macOS information stealer written in Go that focuses on cryptocurrency holders. It uses ClickFix social engineering and malicious DMG installers, coerces victims into granting Full Disk Access to bypass TCC protections, downloads modular payloads to steal messages, notes, browser data, Telegram data, credentials, and crypto wallet information, can replace legitimate wallet apps with trojanized versions, and maintains a persistent WebSocket connection to a Firebase-hosted C2 for remote commands.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.