Fresh malware targeting Apple users in the US and Germany is infecting Bitcoin and Exodus cryptowallet applications with a Trojan distributed through pirated software, according to Kaspersky researchers.

The malware is delivered via cracked applications and can replace Exodus and Bitcoin cryptowallet applications installed on the user’s machine with infected versions that steal secret recovery phrases after the wallet is unlocked.

The report, issued this week, noted the attackers use DNS TXT records to deliver an encrypted Python script to their victims as the second stage of infection.