Security researchers have uncovered a concerning trend targeting Mac users through 14 deceptive application installers. These installers, masquerading as legitimate software, deploy a remote-access trojan designed to steal user credentials.
Background of the Campaign
The fake installers are distributed as macOS disk images and installer packages. This method provides attackers with an alternative entry point, particularly targeting developers and job seekers. The campaign is associated with the longstanding Contagious Interview operation, where attackers impersonate recruiters to send coding tests or packages to unsuspecting candidates.
This latest tactic shifts the threat outside typical developer environments by embedding malware within software installers. Jamf Threat Labs identified the cluster of installers and connected their infrastructure to prior attacks involving Git-hook and Visual Studio Code task files.
The Threat Unveiled
The ultimate goal of these fake installers is to deploy OtterCookie, a remote-access trojan capable of extracting browser and cryptocurrency-wallet credentials, scanning for sensitive files, and monitoring clipboard activity. This threat extends beyond a single deceptive download; bypassing macOS security warnings can activate a decoy application while the malware operates covertly in the background.
According to Jamf, this strategy provides attackers access to valuable account information and a means to issue commands on compromised Macs. Security teams are advised to treat reports of unsolicited software as potential security incidents, especially if candidates are asked to disable protections or install software from unverified sources.
Technical Details and Precautions
The 14 malicious samples mimic popular applications such as The Unarchiver, Presentify, and others. Both DMG and PKG versions are found, all lacking valid signatures and notarization. In these disk images, attackers modify the app configuration so a concealed executable runs when the user opens the bundle. This approach mirrors previous malicious Git-hook attacks that used job-related coding tasks to activate malware.
In the package route, an unsigned installer uses preinstall and postinstall scripts to execute the malware. The hidden executable is designed for Intel processors, necessitating Rosetta 2 on Apple silicon Macs. This dependency highlights the persistence of x86-64 macOS malware, although user interaction is still required.
Conclusions and Recommendations
This campaign demonstrates the evolving tactics used to exploit job lures and expand attack vectors. Users are urged to source Mac software exclusively from trusted origins, verify developer signatures, and resist bypassing security features for unfamiliar applications.
Organizations should maintain robust threat prevention and detection systems, especially for staff engaged in external coding or interview tasks. Reviewing repositories and scripts before execution can prevent similar incidents. The enduring appeal of familiar Mac app names as bait underscores the need for constant vigilance in cybersecurity practices.
