Rust Door and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector
Summary: Unit 42 documented a macOS campaign in which attackers posing as recruiters or prospective employers trick job-seeking software developers in the cryptocurrency sector into running a malicious Visual Studio project, which downloads RustDoor binaries and a previously undocumented macOS variant of Koi Stealer. The Koi Stealer sample masquerades as a Visual Studio update, prompts for the root password, and exfiltrates data including browser files, SSH keys, Keychain files, Telegram and Discord data, and cryptocurrency wallets to a command-and-control server, while RustDoor attempted to steal LastPass credentials and open reverse shells to 31.41.244[.]92 over TCP port 443.
What's compelling: Unit 42 assesses with moderate confidence that this activity was carried out on behalf of the North Korean regime, and the reverse-shell IP has a history of malicious use since at least 2022, previously tied to RedLine Stealer. A fake Visual Studio update that asks for the root password and then copies Keychain files and crypto wallets is a direct path from one developer's laptop to the treasury.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026