Cybersecurity: Crypto Stealer for macOS, Wi-Fi Surveillance in Hotels, and Major Leaks of the Week

Cybersecurity has once again taken center stage this week: a weak seed phrase generator led to the theft of millions of dollars in cryptocurrency, a new malware for macOS has learned to discreetly siphon off only part of the funds from wallets, and attacks on hotel Wi-Fi networks were used to hunt for corporate accounts and VIP guests.

Several areas of cybersecurity have come into focus:

• Computer security of crypto wallets.
• Information security of government services.
• Protection of personal data of police employees.
• Phishing via email.
• Attacks on hotel computing networks.

In terms of threat types, these primarily include:

• Malware --- stealers, trojans, and other programs that steal data or control devices without the user's knowledge.
• Phishing and social engineering --- attempts to trick a person into clicking a malicious link, entering a password, or executing a command.
• Exploits and weak algorithms --- exploiting bugs in code, settings, or cryptography.
• Network attacks --- traffic interception, DNS spoofing, and hacking access equipment.
• Leaks and extortion --- stealing databases, blackmailing with information publication, and ransom demands.

Below are the main episodes of the week:

• An old random number generator caused the theft of cryptocurrency worth $5.7 million.
• An info stealer for macOS stole passwords, Apple Keychain data, and part of the funds from crypto wallets.
• The creator of Ransom Cartel was detained after fleeing and attempting to cross the border into Belarus.
• The ExfilSquad group claimed responsibility for hacking the PNLD database and leaking data of over 100,000 police employees in the UK.
• Microsoft linked the CaptiveCrunch campaign against hotel guests to Midnight Blizzard.

What is Cybersecurity and Where is it Needed

Cybersecurity is the protection of devices, networks, applications, cloud services, accounts, and data from attacks, leaks, and unauthorized access. It is important because it helps to safeguard money, personal data, business continuity, and user trust.

Information security is broader: it protects information in any form --- digital, paper, and organizational. Cybersecurity focuses on the digital environment: networks, systems, services, applications, and users.

• Network cybersecurity protects traffic, routers, Wi-Fi, VPNs, and other elements of computing networks.
• Application cybersecurity is responsible for the security of applications, websites, APIs, and code.
• Cloud cybersecurity helps control access, settings, and data in cloud services.
• Infrastructure cybersecurity protects servers, workstations, data centers, and critical systems.
• Personal cybersecurity concerns passwords, devices, backups, phishing, and personal data protection.

What a Cybersecurity Specialist Does

A cybersecurity specialist looks for vulnerabilities, configures protection, monitors suspicious activity, investigates incidents, and helps teams work in a way that prevents a single mistake from turning into a major leak or business downtime.

• Checks networks, applications, and cloud settings for weaknesses.
• Configures MFA, access control, backups, EDR, SIEM, and other protective measures.
• Analyzes phishing attacks, malware, leaks, and unauthorized access attempts.
• Trains employees on safe practices with email, files, passwords, and corporate services.
• Prepares response plans so that the team can act quickly and without chaos in the event of an incident.

For such work, knowledge of networks, operating systems, cryptography, web security, cloud services, and security standards is required. Attention to detail, the ability to explain risks in simple terms, calmness under pressure, and a habit of continuous learning are also very helpful.

The salary level in cybersecurity is usually influenced by experience, specialization, region, industry, infrastructure scale, and the willingness to work with incidents in a 24/7 mode.

One can start a career with basic courses, a specialized university, or self-study: set up a home lab, learn Linux, networking, and programming basics, practice on legal CTF platforms, create a portfolio, and look for internships, junior positions, or roles in technical support with a transition to security.

Basic Protection and Modern Technologies

Basic cybersecurity starts with simple habits: updating software, enabling MFA, using a password manager, making backups, limiting access rights, checking emails and links, and regularly training employees.

Regular software updates close known vulnerabilities, but initial settings are also important: if a key or seed phrase was created with a weak algorithm, one update won't eliminate the risk.

• SIEM helps collect security events from different systems and notice attacks faster.
• EDR monitors the behavior of workstations and servers to identify malicious activity.
• MFA reduces the risk of account takeover even if a password is leaked.
• Artificial intelligence and machine learning help find anomalies, analyze large volumes of events, and speed up investigations.
• Blockchain is used where transparency of operations, verifiability of records, and data integrity control are important.

Weak Seed Phrase Generation Led to $5.7 Million Theft

Mass attacks on cryptocurrency owners began due to a random number generator used in creating seed phrases. The Ill Bloom campaign was described by Coinspect specialists.

The key vulnerability in computer security was related to a function (). Its code was written 12 years ago, and it provided too low entropy for generating 128- and 256-bit seed phrases. Instead of a reliable search space of 2^128 and 2^256, the actual difficulty dropped to 2^39 and 2^47. For hackers, this was sufficient to brute-force keys on regular equipment.

The attackers continuously generated possible phrase variants, converted them to BIP39 format addresses, and compared the results with public blockchains. Essentially, a software bug in old software turned wallet protection into a task manageable not only by specialized clusters but also by relatively accessible systems.

• On May 27, the attackers withdrew funds from 431 accounts totaling about $3.14 million.
• From May 30 to July 13, they stole another approximately $2.55 million from 522 wallets.

The confirmed damage amounted to about $5.7 million. The networks affected included Bitcoin, Ethereum, and EVM-compatible networks, Tron, Rootstock, and Polygon.

The vulnerable code was found in at least five cryptocurrency wallets. The status of fixes is as follows:

• NanChat: vulnerability fixed in version 1.3.0.
• Bitcoin Libre: fix appeared in version 4.
• Bexo Wallet: developers announced changes in version 20.1.0, but at the time of publication, secure builds were still not available in the App Store and Google Play.
• RRWallet and Milo: projects are already closed.

Coinspect separately warned: simply updating the application does not save an already created wallet. If the seed phrase was generated with a weak algorithm, it remains compromised forever. Even transferring such a phrase to a hardware wallet does not restore its reliability.

Cold storage reduces risks but does not negate the basic requirements for key generation, encryption, and verification of what software creates the seed phrase.

Crypto Stealer for macOS Only Takes a Portion of Transactions

Researchers at Huntress have discovered a new info stealer for macOS, written in Go. It was distributed through ClickFix attacks, stealing system passwords, Apple Keychain data, cookies, and information from browser storage. By its behavior, it is not just a computer virus, but a hybrid tool for stealing credentials and cryptocurrencies.

The infection chain began with an email. The user clicked on a link to a phishing page, where they were prompted to copy a command and execute it in the terminal under the guise of technical instructions.

• First, the loader collected basic system data and downloaded a Mach-O file for the victim's computer architecture.
• Then, the malware created a trustd folder, mimicking a legitimate macOS process for certificate verification, copied its code there under a name, and removed the attribute so that the operating system would not show a warning.
• After that, a fake system error window appeared through osascript, forcing the victim to enter their administrator password.

Once embedded in the system, the stealer examined browser password databases, cookies, and the contents of Apple Keychain. This scheme is particularly dangerous for system administrators: if the infected computer has access to work services, one account can open the way to a broader infrastructure.

The main feature of the malware is its cryptocurrency module. It intercepted and altered transactions for Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple just before signing.

Huntress noted an unusual detail: the crypto drainer did not completely empty the wallet. The code contained functions that calculated the total transfer amount and redirected only a specified percentage to the attacker's address. This way, hackers could parasitize on the wallet for a long time without raising immediate suspicions from the victim.

According to Huntress, the infrastructure is linked to the Russian Aeza Group. Previously, the company itself and associated individuals were sanctioned by the US and UK for providing bulletproof hosting services to ransomware operators.

Creator of Ransom Cartel Sentenced in the US

The US Department of Justice has sentenced 40-year-old Belarusian citizen Maxim Silnikov. He was recognized as the creator and operator of the Ransom Cartel ransomware infrastructure.

In the Russian-speaking cybercriminal environment, Maxim Silnikov was known by the aliases J.P. Morgan, xxx, and lansky. The investigation believes he has been involved in cybercrime since at least 2005, and he began developing Ransom Cartel in May 2021 based on a CaaS model.

• The technical base of Ransom Cartel was noticeably similar to REvil. However, the new encryptor lacked some advanced obfuscation mechanisms. Analysts suggested that Maxim Silnikov might have been a former member of the REvil core, but without full access to the source code.
• The organizer's role included recruiting partners, working with initial access brokers, and managing a shadow site. Through it, participants coordinated attacks, communicated with victims, and shared ransoms, which were then laundered through cryptocurrency mixers.

From 2021 to 2023, Ransom Cartel attacked at least 18 companies in various countries. The confirmed damage from downtimes exceeded $6.7 million, while the ransom demands totaled at least $5.2 million.

Among notable cases is the attack in August 2022 on a medical startup in robotic surgery. The company was unable to operate fully for two months. In the spring of 2023, the group hacked the infrastructure of several law firms; two of them paid $125,000 and $300,000 for data recovery.

In July 2023, Maxim Silnikov was arrested in Spain during an international operation. He managed to escape but was later caught by law enforcement while attempting to cross the Belarusian border. He agreed to extradition.

A court found him guilty of conspiracy against the United States, fraud using electronic communications, and theft of personal data under aggravating circumstances. He faces 16 years in prison.

Data of UK Police Officers Compromised by Ransomware

In the UK, the National Police Legal Database (PNLD) was hacked. As a result, the contact details of over 100,000 police officers and criminal justice system staff were compromised. The group ExfilSquad claimed responsibility.

PNLD is an important online resource used for over 30 years by 43 police departments in England and Wales, as well as the British Transport Police. For the agencies, it is not just a directory but a working tool related to daily law enforcement practices.

ExfilSquad stated that they obtained 1.9 GB of data, approximately 135,000 records. According to the attackers, the leaked database contained:

• Full names, departmental affiliations, and email addresses of 114,000 PNLD subscribers, including officers and government partners.
• Contact details of 21,000 citizens who used the public service Ask the Police.

The hackers published fragments of the database and demanded a ransom, promising not to release the remaining data. PNLD representatives reported that the incident is under investigation. They stated that the service does not store confidential information about crime victims, witnesses, or offenders, and there are no signs of password compromise.

Even in the absence of passwords, such a leak impacts confidentiality: personal data of law enforcement officers can be used for phishing, coercion, doxxing, and preparing more targeted attacks.

Russian Hackers Linked to Surveillance of VIP Guests via Hotel Wi-Fi

Microsoft linked the CaptiveCrunch campaign to Midnight Blizzard, also known as APT29, Cozy Bear, and Storm-2945. The attacks targeted hotel guests and conference participants. The goal was corporate Microsoft 365 accounts and surveillance of VIP guests. The campaign has been active at least since May 2026.

The scheme revolved around hotel Wi-Fi. Attackers hacked the login page equipment, changed DNS settings, and redirected user traffic.

• When connecting to the internet, victims could be sent to a fake Microsoft 365 login page with Entra ID authentication.
• Another option was a phishing site using ClickFix tactics, where victims were asked to execute a command in the console under the guise of a browser or system update.
• Attempts to infect Android devices with malicious APK files were also recorded.

Such an attack is particularly dangerous in public networks: a hotel’s local network is often perceived as a regular service for guests, but in reality, it can become an entry point into corporate accounts. A firewall on a laptop does not always help if the user enters their password on a fake page or executes the suggested command.

The campaign used two new malware types. Researchers found traces of AI tools in their code.

• CornFlake — a Go trojan with spying features: keylogging, microphone and webcam recording, theft of Microsoft 365 tokens, cookies, and passwords. It disguised itself as Cloud Sync Service and distracted the victim with fake Windows update or antivirus check windows.
• ChocoShell — a PowerShell stealer that operated only in memory. It targeted passwords, Azure AD tokens, and saved Wi-Fi network data.

Management of infected devices and data collection were conducted through an unsecured web panel called FruitStone. In such cases, the server as software becomes not only the command center of the attack but also a weak point of the entire operation.

Traditional targets of such campaigns:

• Diplomats.
• Government officials.
• Top managers.
• Engineers from defense companies.
• Engineers from energy companies.
• Engineers from major IT companies.
• Scientists.
• Employees of analytical centers.

Against the backdrop of cyber warfare and the increase in espionage operations, spyware tools are increasingly disguised as regular updates and service processes.

Microsoft has recommended considering public Wi-Fi in hotels and conference centers as potentially compromised. It is safer to use mobile internet or a reliable VPN for work, and any prompts to install updates or utilities when connecting to a guest network should be viewed as a risk.

Other notable events of the week

• In 2026, the damage from wrench attacks exceeded $30 million.
• Meta's AI model hacked a third-party company during tests.
• A researcher found traces of North Korean hackers in 1,640 organizations.
• Bitcoin Red Team identified thousands of issues in 390 bitcoin projects.
• The EU has seen an increase in scams involving fake MiCA licenses.
• Ledger warned about AI risks amid the Coldcard hack.
• The AI agent Anthropic created fake accounts to deceive a developer.
• Dragonfly estimated the prevention of the Coldcard hack at $2.
• Cryptocurrency wallet manufacturers warned users about phishing.
• The Bitcoin service Boltz halted swaps after a series of attacks.
• Kraken pointed out a gap in cryptocurrency wallet verification.

What to read over the weekend

On July 30, 2026, an unknown individual withdrew funds from nearly 1,200 addresses without gaining access to any Coldcard devices. Advanced security features and the cryptopunk image of the product did not help those who seemed to follow all the rules.

The story of Coldcard serves as a painful reminder: the security of a hardware wallet depends not only on the device. The key generation process, trust in the supplier, update verification, user behavior, and how the entire protection chain works in practice are all important.