SlowMist and Chainbase jointly disclose that a Token Vesting phishing attack targeting macOS is spreading. The attacker disguises as emails such as "Audit/Compliance Confirmation" or "Token Unlock Confirmation," delivering malicious attachments with double extensions (e.g., .docx.scpt) to trick users into executing scripts, thereby stealing system passwords, bypassing TCC permissions, and deploying a Node.js backdoor. The security team reminds users that if they have opened the attachment or entered a password, they should immediately disconnect from the internet and investigate their system.