Reaper malware targets macOS crypto wallet apps

TLDR

Reaper is a new macOS malware strain that targets crypto users by impersonating wallet apps and stealing passwords and wallet data.

1. Reaper spreads via fake download pages that mimic popular apps and uses Apple's Script Editor to trick users into running malicious code and entering their Mac password.
2. Once installed, it can target desktop wallets like Ledger Live, Trust Wallet, and Exodus, modify app code to hijack future transactions, and steal browser credentials and wallet-related files.
3. The main defenses are strict download hygiene, refusing unexpected password/script prompts, and treating any recent wallet install from non-official links as potentially compromised.

Deep Dive

1. How Reaper Infects macOS

Reports describe Reaper as a macOS malware campaign distributed through fake app download pages that imitate legitimate software sites, including pages for crypto-related tools and wallets.

The malware prompts users to open Apple's Script Editor, then shows a convincing fake security update window to capture the device password before installing itself as a persistent backdoor. This flow has been highlighted in coverage of the Reaper macOS malware targeting wallet users on Mac.

2. What It Targets And Steals

Reaper is reported to focus on desktop wallet applications, including Ledger Live, Trust Wallet, and Exodus, by potentially modifying their code to intercept or redirect future transactions, not just the current session.

It can also grab stored browser credentials from Chrome, Firefox, and Edge, and exfiltrate certain document and wallet-related files, which could include keystore files or saved private keys if those are present on disk. One security write?up notes this broader data theft alongside the wallet?hijacking risk for Reaper macOS malware.

3. Practical Defenses For Crypto Users

1. Only download wallet apps from official sites you type yourself or from the official Mac App Store; avoid links in ads, email, and social media.
2. Treat any prompt to open Script Editor or enter your Mac password outside normal app installation flows as suspicious and cancel immediately.
3. If you recently installed or updated a wallet from a questionable link, assume compromise: move funds to a fresh wallet created on a known?clean device, then wipe and rebuild the Mac if possible.

Conclusion

Reaper shows how Mac users are now prime targets for crypto?focused malware, combining fake download sites, social engineering, and code tampering against popular wallets. For anyone holding significant value on a desktop Mac, the real protective edge is strict download discipline, skepticism toward unexpected prompts, and keeping large balances on wallets that never share their keys with an internet?connected computer.