MacHabitsSecurity
Crypto, malware, and the settings that keep a Mac and its accounts safe.
If you keep crypto on a Mac this week: update macOS, verify your wallet apps, and get seed files out of iCloud
A CoreGraphics zero-day fix, a MacSync version that swaps Ledger apps, and stealers that search for files named seed and wallet. Three checks, in order, that take fifteen minutes.
Drained while the MacBook slept: the hot wallet threat model on a Mac
Wallets get emptied at 3 a.m. while the laptop is closed. That’s because the thief signs transactions on their own machine with your stolen vault and password. How they get them, what macOS does and doesn’t protect, and a setup that works.
Still need an Intel wallet app? Stay on macOS 27, and don’t plan on 28
macOS 27 is the last version where Intel-only apps run on Apple silicon. If your wallet is one of them, your coins are safe, but your plan needs to change. What to secure, how to test a native wallet, and how to stay on 27 safely.
Clean install ate your keychain? Why a copied keychain file won’t open, and what still works
After erasing your Mac, the old login keychain opens but shows nothing, or gets renamed. On Apple silicon, a keychain file copied by hand is no longer a backup. What changed, how to recover what you can, and how to test your backups now.
Security PSA: install 27.0.1 on Golden Gate, or 26.7.1 and 15.8.1 if you stayed behind
Apple released three macOS updates on September 28. Tahoe 26.7.1 and Sequoia 15.8.1 fix a CoreGraphics flaw Apple says may have been exploited. Which one you need, and how to install it without upgrading to Golden Gate.
MacSync and deploy_ledger: how the fake Ledger app works, what the iCloud calendar really does, and how to check yours
A new MacSync version installs a backdoor disguised as Finder that can replace your Ledger app. What you see on screen, why the iCloud calendar isn’t your account being hacked, and the commands that show whether your Ledger app is real.
The app in your Dock may not be the app you installed: how to verify any Mac app in a minute
Tampered copies look identical to the real thing. How to check who signed an app, whether it was changed and whether Apple notarized it, plus how to verify downloads before opening them.
How do I remove this malware? A practical check for Mac infections in 2026, and what to do if you pasted a Terminal command
If you ran a command from a fake CAPTCHA or verification page, treat your Mac as compromised now. Here is what to check, where Mac malware hides, how to remove it, and why a factory reset may be the only real fix.
Apple is tightening Full Disk Access on Mac because of AI agents: how to check which apps have it today
On October 2 Apple said Full Disk Access will get extra controls because of AI agents. Nothing has changed yet. Here is what the permission exposes, how to audit it in two minutes, and which apps really need it.