CoreLock is a Mac security app for cryptocurrency users. Mac Security Built for Crypto Users. Your Mac holds wallet keys, seed phrases, and exchange sessions. Infostealers are designed to harvest it quickly. CoreLock checks for some of the footholds they rely on, like unsigned apps and unusual launch agents.
Built for Cryptocurrency Users
Your Mac holds wallet keys, seed phrases, and exchange sessions. Infostealers are designed to harvest it quickly. CoreLock checks for some of the footholds they rely on, like unsigned apps and unusual launch agents.
Download CoreLock FreeFree tier included — no credit card required
These are the risks cryptocurrency users face every day.
Atomic Stealer, Realst, and Banshee specifically target MetaMask, Phantom, Coinbase Wallet, and other browser extensions. CoreLock flags unsigned apps and unusual launch agents of the kind these stealers rely on, but it cannot guarantee it will catch every variant.
Crypto users are targeted with fake meeting invitations (Meeten, Meetio) and fake blockchain game downloads that install infostealers. CoreLock's Apps screen flags unsigned apps, and its Network screen lists your apps' open connections.
Even with 2FA enabled on exchanges, stolen session cookies let attackers access your accounts directly. CoreLock cannot see session cookies. It can flag risky processes and list open connections. Use hardware security keys where an exchange supports them.
If you use AI agents like OpenClaw or Claude Code, they can access .env files, wallet configs, and API keys. A prompt injection attack could exfiltrate these without your knowledge. CoreLock recognizes supported AI agents and shows the files and connections they have open.
CoreLock is not a generic antivirus. These are the capabilities that make a real difference for your work.
Flags unsigned or unusual launch agents at each scan, and unsigned apps on the Apps screen, the kind of footholds Atomic Stealer, Realst, Banshee, and Cthulhu Stealer rely on.
Lists your apps' open connections by IP address and port, so you can spot a process talking to an address you do not recognize.
Flags unsigned apps and broken signatures, and known-bad tools and risky command lines among running apps. It cannot guarantee it will catch an infostealer before it runs.
With Full Disk Access, see which apps hold files and folders, camera and microphone permissions. The scan also flags sensitive permissions left behind by apps you removed.
The free tier (unlimited scans, 3 AI analyses per day) is a way to check your Mac after software installs. Pro ($9.99/month) removes the AI analysis limit.
View All PlansYou run untrusted code, manage SSH keys, and juggle dozens of packages. CoreLock checks running apps, open ports and login items every 15 minutes by default.
Your Mac is your business. Client files, invoices, contracts — one breach and your reputation is on the line. CoreLock checks it every 15 minutes by default and explains what it finds in plain English.
Your Mac holds your thesis, projects, and personal data. CoreLock helps you see what is running on it — and it starts free.
Kids download apps, click links, and grant permissions without thinking twice. CoreLock checks the Mac every 15 minutes by default and tells you what matters.
You cannot afford a full IT team, but you cannot afford a breach either. CoreLock gives small businesses a plain-English view of what is running on their Macs.
Working from home means your personal Mac is your office Mac. CoreLock helps you see what is running on the Mac that holds your work.
CoreLock doesn't directly secure your wallet — that's your wallet software's job. CoreLock shows which apps have access to your files and which processes make network connections, which can help you spot an infostealer. It cannot guarantee it will catch every one.
The major ones in 2026 are Atomic Stealer (AMOS), Realst, Banshee Stealer, and Cthulhu Stealer. All of them target MetaMask, Phantom, Coinbase Wallet, and other popular browser extensions. They also target the macOS Keychain where some wallet apps store credentials.
Yes — a hardware wallet is the best defense for significant holdings because the private keys never touch your Mac. But you still need to protect your exchange sessions, hot wallets for daily use, and the Mac where you manage your portfolio. CoreLock can help you check that Mac.
Yes, through session cookie theft. Infostealers capture the session cookies from your browser after you've authenticated with 2FA. The attacker can then use these cookies to access your exchange account directly, without needing your password or 2FA code. CoreLock cannot see or block session cookie theft; use hardware security keys where possible and review active sessions regularly.
Download CoreLock and run a free scan on your Mac. Free to start, no credit card required.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser