Loading story…
North Korean-linked threat actor BlueNoroff has been observed targeting macOS users through lures tied to fake cryptocurrency news, extending the group’s financially motivated intrusion activity into Apple environments. The campaign used social engineering themes designed to appeal to crypto-focused victims, indicating continued interest in organizations and individuals involved in digital assets and related financial operations.
Researchers reported that the operation also introduced novel persistence techniques on Macs, suggesting a more mature toolset for maintaining access after initial compromise. The activity highlights a growing risk to enterprises that rely on macOS endpoints in finance and cryptocurrency-adjacent workflows, where trusted news themes and investment-related content can be used to deliver malware and support long-term unauthorized access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SentinelOne published research on a BlueNoroff campaign dubbed 'Hidden Risk' targeting macOS users with fake cryptocurrency news lures and a novel persistence technique. The report publicly revealed the campaign and its tradecraft.
Elastic Security Labs published research on a DPRK-linked intrusion set using a new variant of the RUSTBUCKET malware. The report disclosed earlier macOS-focused tradecraft associated with the actor later tracked in related BlueNoroff activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actor BlueNoroff, a sub-cluster of the Lazarus Group, has launched two sophisticated campaigns—GhostCall and GhostHire—targeting executives in the fintech, venture capital, and Web3 development sectors. According to Kaspersky and corroborated by multiple sources, GhostCall leverages social engineering via platforms like Telegram to lure technology and venture capital executives into fake investment meetings, ultimately tricking them into downloading malicious scripts disguised as Zoom updates. These scripts deploy infection chains on macOS devices, resulting in credential theft and system compromise. GhostHire, meanwhile, targets Web3 developers by inviting them to complete skill assessments through booby-trapped GitHub repositories, which deliver tailored malware payloads based on the victim's operating system. Both campaigns demonstrate BlueNoroff's evolving tactics, including the use of generative AI for malware development and a shift from macOS to Windows platforms. Researchers note that these operations are part of BlueNoroff's broader, years-long SnatchCrypto campaign, which aims to steal cryptocurrency and financial data to fund the North Korean regime. The campaigns employ advanced social engineering, cross-platform malware, and innovative infection vectors, highlighting the group's increasing sophistication and adaptability. The targeting of high-value individuals in the fintech and Web3 sectors underscores the persistent threat posed by North Korean APTs to the global cryptocurrency ecosystem, with significant financial and reputational risks for affected organizations and individuals.
Jun 29, 2026
North Korea-linked **BlueNoroff** has been tied to two coordinated intrusion campaigns, **GhostCall** and **GhostHire**, aimed at blockchain developers, executives, managers, and venture capital contacts in the Web3 ecosystem as part of its broader **SnatchCrypto** activity. Researchers said GhostCall lured victims into fake Zoom or Microsoft Teams meetings arranged through Telegram and phishing domains, then tricked them into executing malicious AppleScript on macOS or clipboard-swapped commands on Windows. GhostHire used recruiter impersonation to deliver poisoned coding assignments through Telegram bots, GitHub repositories, and trojanized Go or TypeScript projects. The operations used overlapping infrastructure and a broad malware toolkit spanning at least seven modular macOS infection chains, with families including `DownTroy`, `ZoomClutch`, `TeamsClutch`, `CosmicDoor`, `RooTroy`, `RealTimeTroy`, `SneakMain`, `SysPhon`, and `SilentSiphon`, alongside a keylogger. The actor expanded beyond earlier standalone malware into modular launchers, loaders, droppers, injectors, and stealers written in AppleScript, Go, Nim, Rust, Swift, Python, and C++, and also extended tooling to Windows and Linux in GhostHire. Investigators also observed the use of AI to refine social engineering and enhance images, while stolen webcam footage from victims was reportedly reused in later fake calls to make the scams more convincing; victims were identified across multiple countries, particularly in the Asia-Pacific region.
Jun 29, 2026
North Korea-aligned threat actor BlueNoroff, also known as APT38, has launched two new campaigns, GhostCall and GhostHire, targeting executives, Web3 developers, and blockchain professionals across multiple countries. The campaigns use sophisticated social engineering tactics, such as fake investor meetings and bogus recruiter tests, to lure victims via platforms like Telegram and LinkedIn. Victims are tricked into downloading malicious files during staged video calls or through fraudulent meeting invitations, leading to the deployment of multi-stage, cross-platform malware on both macOS and Windows systems. The malware, written in languages such as Go, Rust, Nim, and AppleScript, includes payloads like DownTroy, CosmicDoor, Rootroy, and others, each designed for credential theft, keylogging, persistence, and further compromise. GhostCall primarily targets tech firm and venture capital executives, especially in countries such as Japan, Italy, France, Sweden, Spain, Turkey, India, Hong Kong, and Singapore, by exploiting fake investment meetings to deliver AppleScript-based malware. GhostHire focuses on Web3 developers and the broader blockchain industry, distributing malicious ZIP files that infect Windows machines with additional payloads, including a Rust-based loader. Researchers have observed that BlueNoroff's adoption of generative artificial intelligence has accelerated the development of their cross-platform malware, underscoring an evolution in both technical sophistication and targeting strategy within the ongoing SnatchCrypto operation.
Jun 29, 2026