Loading story…
A DPRK-linked campaign is targeting macOS users with fake full-screen update prompts delivered through malvertising or injected scripts, tricking victims into pasting a clipboard-loaded command into Terminal. The command launches a multi-stage infection chain tied by tradecraft to UNC5342 and Contagious Interview, installing Node.js and an obfuscated backdoor that retrieves command-and-control settings from Ethereum smart contracts through public RPC endpoints. By using EtherHiding instead of fixed infrastructure, the operators make their C2 configuration more resilient to disruption and takedown.
After execution, the malware deploys an infostealer aimed at 157 cryptocurrency wallets, browser secrets, and developer credentials, and installs a malicious Chrome extension masquerading as Google Drive Offline to maintain browser-level access. AllSecure linked the malware, infrastructure, extension, and on-chain funding flows to a broader crypto-theft operation, tracking 464.80 ETH—about $890,000—into attacker treasury infrastructure between late May and July 2026, with laundering paths leading toward tagged phishing-related sink wallets. Defenders are advised to treat any host where the pasted command was executed as fully compromised, isolate it immediately, reset credentials from a clean device, and move cryptocurrency assets to a clean wallet.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Huntress identified the MacSync macOS information stealer during a mid-July intrusion investigation. The campaign used sponsored Google results and a fake Claude installation guide to trick victims into pasting a malicious Terminal command, leading to credential theft, wallet targeting, persistence, and RAT deployment.
AllSecure tracked 464.80 ETH, valued at about $890,000, flowing into attacker treasury infrastructure. The tracked inflows occurred between late May and July 2026 and were cited as part of the operation's wallet and laundering trail.
AllSecure published a report linking the campaign's infrastructure, malware, browser extension, and on-chain funding flows to a DPRK-linked crypto-theft operation aligned with UNC5342 and Contagious Interview tradecraft. The report also described disposable wallet deployment patterns, exchange-funded operating capital, and laundering paths into tagged sink wallets.
During a malvertising investigation, AllSecure identified a macOS-focused campaign that used fake update screens to trick users into pasting a malicious command into Terminal. The infection chain installed a Node.js backdoor that retrieved command-and-control configuration from Ethereum smart contracts and deployed tooling to steal wallet data, browser secrets, and developer credentials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcebsky.app
Open sourceallsecure.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly compromising macOS systems through **ClickFix** and related social-engineering lures that trick users into pasting malicious commands into Terminal, often behind fake Cloudflare checks, bogus troubleshooting steps, fraudulent support messages, or compromised websites. A large campaign tied to hundreds of hacked WordPress sites served platform-specific payloads and used the **Polygon** blockchain to hide command-and-control locations, while the macOS payload ran largely in memory, harvested Keychain data, browser information, SSH keys, screenshots, and other files, then staged stolen data in `/tmp/osalogging.zip` before exfiltrating it. Researchers said the technique does not rely on a macOS software flaw, but on convincing victims to execute attacker-supplied commands themselves. Threat reporting indicates the tactic has become a dominant initial-access method against Mac users, especially cryptocurrency holders and developers, and that recent Apple paste warnings in Terminal have already been bypassed through Script Editor abuse. Separate intrusion research linked cryptocurrency-focused activity to malware families including **DEEPBREATH**, **SUGARLOADER**, and **CHROMEPUSH**, showing how post-compromise tooling on macOS can escalate from social engineering to broad credential and data theft by targeting `TCC.db`, Keychain contents, Chromium-based browsers, Telegram data, and Apple Notes. Security teams are being urged to prioritize behavioral detection, cross-platform response, and user controls that prevent unverified command execution on Macs.
Jul 16, 2026
A DPRK-linked **XCTDH** campaign targeting cryptocurrency and software developers has added an Ethereum-based command-and-control recovery mechanism, **HashHiding**, to its existing multichain infrastructure. Malware scans transactions from a designated Ethereum signal wallet and decodes a replacement C2 IPv4 address and port from the recipient address of ordinary coin transfers, allowing operators to rotate infrastructure without updating malware. Researchers observed 2,655 Ethereum beacon transactions and four C2 rotations; HashHiding operates alongside hardcoded C2 servers and a TRON/Aptos-to-BNB Smart Chain payload-resolution chain. The operators use fake job offers, poisoned GitHub repositories, and trojanized NPM packages to deliver the Node.js-based **DEV#POPPER.js** RAT and **OmniStealer** credential harvester across Windows, macOS, and Linux. The RAT can execute commands and collect keystrokes and clipboard data, while OmniStealer targets browser, password-manager, cloud-storage, and cryptocurrency-wallet data. The activity reflects broader adoption of blockchain dead drops—public-chain transactions, smart contracts, or wallets used to carry C2 instructions or payload pointers—by DPRK, Iranian, and criminal operators, making conventional server blocklisting insufficient without detecting the initial developer-targeting infection chain and blockchain-resolution behavior.
Sep 29, 2026
North Korean threat actors expanded beyond traditional espionage into large-scale cryptocurrency theft and intrusion campaigns, with research presented at Black Hat identifying **1,640 organizations in 57 countries** touched by the activity and roughly **700 to 800** showing clearly malicious compromise. Investigators said some intrusions reached **root-level access** on servers and **AWS accounts**, while attackers also abused third-party contractors to reach government, healthcare, and private-sector victims. The activity was linked broadly to DPRK operations including **Lazarus Group**, which researchers said continues to pair social engineering with crypto theft and laundering to generate revenue believed to support sanctions evasion and state priorities. Separate reporting tied the shift to specific DPRK espionage clusters now targeting crypto users and firms directly. **Konni** was described as moving from South Korea-focused Windows espionage to a global **macOS** campaign using fake recruiter or document lures, **AppleScript**, `LaunchAgents`, **TCC** abuse, and payloads including **FileRATClient** and an **EggShell** variant. **Kimsuky** was reported to have operated a fake trading platform, **Tralert FX**, distributing a trojanized desktop app through direct download and the Microsoft Store before deploying a customized **Xeno RAT** via GitLab staging; researchers said that campaign affected more than **250 victim IPs across 28 countries**.
Aug 25, 2026