North Korean threat actors are back at it. This time, however, they are using an advanced macOS malvertising attack where they trick their victims into clicking on fake software update pop-ups and use this opportunity to run malicious code.
The end game? To steal cryptocurrency and data.
The campaign is a new iteration of the long-running Contagious Interview operation, also tracked as UNC5342. AllSecure detailed the attack in a report shared with The Hacker News, and the technical details reveal an impressive level of sophistication.
The main reason why this North Korean macOS malvertising attack is so significant is that it leverages blockchain-based C&C system. The malware uses the smart contract on Ethereum blockchain to get its C&C server address, which makes it hard to shut down.
Let me explain how the attack takes place.
The Fake macOS Update Screen Technique
The defining aspect of this North Korean macOS malvertising campaign is the bogus full-screen macOS software update sequence. When a victim visits a malicious webpage, the browser displays a convincing fake update screen that appears to show the system rebooting or installing an update.
But here is the trick. The fake update screen stealthily copies an attack command to the clipboard. Then it prompts the victim to open the Terminal app and paste the command. The victim, believing their computer is frozen or failing, follows instructions they would otherwise find suspicious.
"The experience is designed to induce panic," AllSecure told The Hacker News. "The computer appears frozen or rebooting, so a user who believes the OS has failed follows instructions they would otherwise find suspicious."
This technique is known as ClickFix, and it is remarkably effective. The attackers succeed in bypassing the skepticism of the victim by inducing panic.
A New Twist to Contagious Interview Strategy
The new macOS malvertising campaign by North Korea is a complete breakaway from conventional Contagious Interview strategies, whereby the cluster has usually used fake job offers, video assessments, or coding tests to get their victims. These methods targeted developers and job seekers.
This campaign starts differently. It begins with a seemingly harmless web search. In the case observed by AllSecure, the victim was searching for electrophoresis machines and clicked on a sponsored result for a company that appeared to sell them. The infection sequence began immediately after the fake page loaded.
"The delivery context is also worth noting: DPRK-linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario," said Christian Papathanasiou, co-founder and CEO of AllSecure. "That does not replace the fake-job pattern; it expands the threat model."
This is an important shift. The North Korean macOS malvertising campaign shows that the threat actors are expanding their targeting beyond the tech sector and job seekers. Any macOS user searching for products or services could potentially be a target.
The Single-Use Activation Mechanism
One interesting aspect of the North Korean macOS malvertising campaign is its single-use activation. AllSecure noted that any attempts to reproduce the infection sequence do not yield the same result. The activation is intended to be single-use.
This makes analysis more difficult for security researchers.This has been done by making the whole process fleeting in nature in order to decrease the time frame of being detected. This is indeed an intelligent move on their part to avoid any kind of analysis.
How the Attack Chain Unfolds
The command pasted into Terminal is a curl command designed to fetch the next-stage malware. This leads to the execution of a Node.js backdoor that uses a LaunchAgent for persistence.
The backdoor calls an Ethereum contract to resolve the C2 server address. This is the EtherHiding mechanism that makes the infrastructure takedown-resistant. The implant is configured to check in with the server every five minutes and execute any JavaScript code returned by it.
The two Ethereum addresses embedded in the malware act as EtherHiding configuration responsible for fetching the actual C2 servers: "rg-telemetry[.]sbs/api" and "th-updates[.]sbs/analytics."
The Blockchain-Hosted C2 Infrastructure
The EtherHiding approach is particularly noteworthy. AllSecure analyzed the Ethereum contracts used in the North Korean macOS malvertising campaign and found a pattern of industrialized deployment.
Each contract was created by a throwaway wallet running an identical four-step script:
- Fund with approximately 0.0126 ETH
- Deploy the contract
- Write the configuration
- Forward the leftover approximately 0.006 ETH onward
- Abandon the wallet
"The pattern suggests an operator that has industrialised deployment: fund, deploy, configure, drain leftovers, abandon, repeat," AllSecure said.
This is a clear sign of a well-resourced and professional operation. The attackers have automated the process of setting up their blockchain infrastructure, and it’s very easy for them to create more contracts whenever required.
The Two Payloads Delivered by the Malware
The North Korean macOS malvertising campaign delivers two additional payloads after the initial backdoor is established.
The first is an information stealer that harvests data from web browsers including Chrome, Brave, Edge, Firefox, Opera, and Vivaldi. It targets 157 cryptocurrency wallets, as well as SSH, AWS, Azure, and npm keys. The tool is an advanced method to steal information from the compromised systems.
The second is a malicious Chrome extension disguised as "Google Drive Offline." The extension is sideloaded into the browser by patching Chrome's Secure Preferences file. Its purpose is to drain the victim's cryptocurrency wallets.
A Single Actor Behind the Operation
Further analysis has determined that both the backdoor and the browser-extension drainer are funded from the same wallet cluster. This indicates that the North Korean macOS malvertising campaign is the work of a single actor rather than multiple independent groups.
It seems that there is some form of organization within the actors as they conduct their activities in an organized manner. The fact that they utilize Ethereum contracts systematically, as well as their social engineering capabilities, is proof of the fact that it is a professional operation.
Contagious Interview's Long History
The Contagious Interview campaign has existed for some years now, mainly focusing on developers and candidates for jobs. This malware cluster is believed to be a creation of North Korean threat actors and employs different baits such as fake job interviews, coding tests, and video assessments.
The latest North Korean macOS malvertising campaign is an upgrade to this approach. With a broader scope, which extends to more general bait than just job advertisements, and focusing on web searchers, the group has widened its range of possible victims.
Implications of This for macOS Users
This North Korean macOS malvertising attack shows that even macOS is susceptible to threats. While people assume that macOS is a more secure operating system than the Windows one, this cannot shield macOS from well-conceived social engineering attacks.
People who use macOS should exercise caution while using the internet and clicking on search engine results, particularly those that are sponsored. Any webpage that shows an update pop-up screen or requests that you enter terminal commands should raise suspicions.
If you see a full-screen message claiming that your macOS is updating or frozen, do not follow any instructions to copy and paste commands. Force quit your browser and restart your system normally. No legitimate macOS update requires you to manually paste commands into Terminal.
Protecting Against This Attack
Organizations can take several steps to protect against the North Korean macOS malvertising campaign.
- User education is the most important defense. Employees need to be trained on how to detect suspicious prompts and not run any command given by unknown sources.
- The endpoint detection and response solution can be used to detect the Node.js backdoor as well as the information stealer.
- Detecting any strange outbound connection to any Ethereum contract or suspicious domains may be helpful too.
- The browser security settings need to be set in such a way that no malicious extension gets side-loaded.
The Bigger Picture
The North Korean macOS malvertising campaign demonstrates the continued evolution of North Korean cyber operations. The threat actors are not resting on their previous techniques. New techniques are being developed by them, widening their targeting scope, and building infrastructure that is resilient to take downs.
Because of its social engineering capabilities, blockchain-enabled C2 and a well-rounded payload, this threat group has become one of the most advanced malware campaigns seen in macOS operating systems within the past few years.
Wrapping It Up
The North Korean macOS malvertising campaign is a sophisticated operation that uses fake software update screens to trick victims into executing malicious commands. The campaign represents an expansion of the Contagious Interview cluster's tactics beyond fake job offers to broader web browsing scenarios.
The use of a C2 infrastructure that uses blockchain makes the attack resilient against takedowns. The info-stealer attacks 157 cryptocurrency wallets, while the malicious Chrome extension empties the victim’s funds.
Mac users should be vigilant. No legitimate update requires you to paste commands into Terminal. If you see a fake update screen, do not panic. Force quit your browser and restart normally. The attackers rely on panic to bypass your better judgment.
The North Korean macOS malvertising campaign is ongoing. Stay safe out there.
FAQ Section
What is the North Korean macOS malvertising campaign?
It is an elaborate attack using deceptive full-screen update screen alerts in macOS to deceive victims into executing commands on Terminal. The attacks deploy malware that enables the theft of crypto currency and valuable information.
How does the ClickFix technique work in this campaign?
The fake update screen copies a malicious command to the clipboard and prompts the victim to paste it into Terminal. The victim assumes that the computer is either frozen or undergoing an update process and hence proceeds to act on instructions which they would have ignored otherwise.
What is EtherHiding?
EtherHiding refers to the technique whereby malware gets the address of the C2 server from an Ethereum smart contract. This makes the infrastructure takedown-resistant because the contracts cannot be easily removed once deployed.
What payloads does the malware deliver?
This malware is capable of delivering an information stealer that specifically attacks 157 cryptocurrency wallets and browser data, alongside a Chrome extension that masquerades as Google Drive Offline and steals from cryptocurrency wallets.
Who is behind this campaign?
The campaign is attributed to North Korean threat actors associated with the Contagious Interview cluster, also tracked as UNC5342. Analysis shows a single operator funded both the backdoor and the wallet drainer.
