A sophisticated cyber operation linked to North Korea is targeting macOS users through deceptive update notifications. This campaign is designed to infiltrate systems by posing as legitimate macOS updates, ultimately installing malicious software.
The operation specifically seeks to compromise cryptocurrency wallets, browser data, and developer credentials. The attack method begins with a fake browser page that mimics a frozen or rebooting Mac screen, prompting users to enter a command in Terminal, which initiates the malware installation process.
Details of the Cyber Attack
Researchers at AllSecure uncovered this campaign while investigating a separate incident involving malvertising. The tactics used in this campaign have been connected to North Korean groups, such as UNC5342, expanding beyond typical phishing attempts aimed at developers and job seekers.
This attack is particularly dangerous due to its combination of social engineering, remote access malware, and the use of blockchain-based infrastructure to control the malware, making it a persistent threat.
Technical Analysis of the Malware
Once the malicious command is executed, a dropper installs Node.js and launches a remote access trojan. Unlike traditional malware, this does not rely on a fixed server but uses Ethereum smart contracts for command-and-control instructions, a method known as EtherHiding.
This approach allows attackers to update their infrastructure without altering the malware on victim devices. The backdoor checks in every five minutes and can execute JavaScript, maintaining persistence through modified system files and hidden cache files.
Impact and Recommendations
The malware collects sensitive data from 157 cryptocurrency wallets, browser credentials, and development environments, posing significant risks to developers and organizations. It also installs a malicious Chrome extension that grants extensive permissions, enabling continuous monitoring and control of browser activities.
AllSecure tracked transactions amounting to 464.80 ETH, valued at approximately $890,000, linked to this campaign. Organizations are urged to isolate compromised devices, reset credentials from secure systems, and ensure cryptocurrency assets are transferred to safe wallets.
Users should be cautious of any macOS update requests that require Terminal commands, a practice not associated with legitimate updates. This awareness is crucial in preventing further compromises from similar threats.
To build resilience against such threats, organizations are advised to strengthen their security operations centers and utilize platforms like ANY.RUN for safe malware analysis.
