Calendar Meeting Links Used to Spread Mac Malware
Summary: Attackers impersonating Signum Capital's Ian Lee on Telegram approached a crypto startup founder, had him book a video call through Calendly, then sent a replacement meeting link that delivered an Apple Script (.scpt) which downloaded and ran a macOS trojan. SlowMist traced the script's text to December 2023 reporting on North Korean state hackers using Calendly's 'Add Custom Link' feature, and Kaspersky attributes the malware to BlueNoroff, a Lazarus subgroup that Recorded Future says has stolen roughly $3 billion in cryptocurrency over six years.
Key Takeaway: A scheduling link inside a calendar invite is now a delivery mechanism, and the script asked the victim to install it himself - no exploit required, so endpoint signatures and XProtect are racing a threat that changes appearance between campaigns.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026