DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
Summary: North Korea-linked actors have been tied to a macOS malvertising campaign in the Contagious Interview line that shows victims a fake full-screen update screen, copies a curl command to the clipboard, and prompts them to run it in Terminal. The malware resolves its command-and-control server from an Ethereum smart contract via EtherHiding, checks in every five minutes, and fetches an information stealer targeting 157 cryptocurrency wallets plus a malicious Chrome extension.
Bottom line: The lure in the observed case was a sponsored search result for electrophoresis machines, not a job offer, so the fake-interview pattern security teams screen for does not cover this entry point. The stealer's reach across 157 crypto wallets and the takedown-resistant Ethereum-hosted C2 mean a single pasted Terminal command can hand over wallet data with no server to seize.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026