notnullOSX Mac Stealer Targets High-Value Crypto Wallet Holders

Researchers reported a new Go-based macOS stealer and backdoor, notnullOSX, being used in highly targeted campaigns against users believed to hold more than $10,000 in cryptocurrency. The malware has been linked to the developer previously known as 0xFFF, later alh1mik, and was first detected in Vietnam, Taiwan, and Spain. Operators are distributing it through social-engineering lures including fake protected Google Docs, ClickFix terminal-prompt tricks, malicious DMG files, and counterfeit WallSpace wallpaper sites promoted through a likely hijacked YouTube channel.

Once victims are persuaded to grant Full Disk Access, notnullOSX can steal browser credentials, Safari cookies, iMessage data, Apple Notes, Telegram sessions, crypto wallet files, and developer secrets. Researchers said the malware uses a modular architecture, downloads components from cdn.filestackcontent.com, and maintains persistent command-and-control through Firebase Realtime Database using SSE, HTTP POST, heartbeat traffic, and WebSocket-style connectivity. One module, ReplaceApp, appears designed to swap legitimate wallet tools such as Ledger Live or Trezor with trojanized versions to capture seed phrases, giving the operation capabilities closer to a remote access trojan than a conventional smash-and-grab stealer.