Downloaded a “fun” Mac app from Reddit - almost lost everything (PSA for hot wallet users)

This is half PSA, half trauma dump, hope it saves someone from my mistake.

A couple of days ago, I saw this Clippy-for-macOS post blowing up on reddit (r/macapps & r/macos). Seemed fun, so I grabbed the "Clippy" .dmg from a GitHub that looked legit (stars, some recent activity). Installed it, played around, forgot about it.

Next day, weird stuff: MetaMask logged out, browser extensions are buggy. Checked my crypto wallet - half my browser wallet funds gone. Not “phishing,” not a fat-fingered transaction, just... vanished. I had an Exodus & Electrum installed as well, where I store most of my crypto, but they weren't touched. Was about to write it off as just my luck, but my friend had me test his crypto security project for Mac crypto wallets he’s been working on. Ran it and instantly flagged some sketchy processes and unknown app running in the background. Turns out the “fun” app was full-on malware trying to sweep everything. Thanks to the warning, I reset everything and the rest of my funds weren’t drained.

Moral:

• Don’t trust random GitHub .dmgs, no matter how many people upvote them.
• Even “safe” apps can be weaponized.
• Antivirus? Did nothing.

Just needed to get that off my chest. Hope it helps someone dodge the bullet.