₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for Apple Jeus Malware
Summary: Volexity observed a North Korean Lazarus Group campaign targeting cryptocurrency users with AppleJeus malware, including a June 2022 domain bloxholder[.]com that cloned the legitimate HaasOnline trading site and an MSI installer bundling the open-source QTBitcoinTrader application with malicious files. In October 2022 the group shifted to malicious Microsoft Office documents whose macros decoded a second OLE object and downloaded a payload from the public file-sharing service OpenDrive, while the malware used a chained DLL side-loading technique in which CameraSettingsUIHost.exe loads dui70.dll from System32, which then loads a malicious DUser.dll.
What you should know: The Lazarus Group keeps retooling against the same target set, moving from MSI installers to Office macros and adding a chained side-loading step, with the stated aim of bolstering DPRK finances - so a cloned trading site and a signed Microsoft binary are the delivery mechanism, not the warning sign.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026