North Korean Hackers Target macOS Through Fake Updates and Search Ads

Researchers at AllSecure have detailed a new iteration of the long-running North Korean campaign Contagious Interview (also known as UNC5342), this time aimed at macOS users. What sets it apart from earlier episodes is the point of entry: not a fake job interview, a test assignment or a video call, but an ordinary search query. In the case they observed, the victim was searching for electrophoresis machines and clicked an ad for a company supposedly selling such equipment.

Panic instead of a hack

As soon as the decoy page opens, the browser goes full-screen and displays a message about macOS rebooting and installing an update. The computer looks frozen or restarting, and the flustered user is primed to follow instructions they would have found suspicious in a calmer state of mind. “The scenario is designed to induce panic,” AllSecure notes.

Once the fake update finishes, the page quietly copies a command to the clipboard and asks the user to open Terminal and paste it. This is the well-known ClickFix technique. The command is a plain curl that downloads the next stage: a Node.js backdoor that establishes persistence via a LaunchAgent. The sequence can't be run through again — activation is meant to be one-time only.

C2 on the blockchain

The most intriguing part is that the address of the command-and-control server isn't hardcoded but embedded in an Ethereum smart contract. The technique, called EtherHiding, makes the infrastructure resistant to takedowns: every five minutes the implant queries the contract, retrieves the current C2 address and executes the JavaScript it receives from there.

The server delivers two payloads. The first is an infostealer that goes after data from browsers (Chrome, Brave, Edge, Firefox, Opera, Vivaldi), 157 cryptocurrency wallets, as well as SSH, AWS, Azure and npm keys. The second is a malicious “Google Drive Offline” extension that plants itself in the browser by editing the Secure Preferences file and drains the victim's wallets.

Analysts traced the financial footprints: two Ethereum addresses are baked into the blockchain, and every contract was created following the same four-step pattern — a single-use wallet was funded with roughly 0.0126 ETH, the contract was deployed, the configuration was written, the remainder (about 0.006 ETH) was moved on, and the wallet was abandoned. “The pattern reveals an operator who has industrialized deployment: fund, deploy, configure, drain the leftovers, discard, repeat,” the researchers say. A shared wallet cluster between the backdoor and the drainer points to a single actor.

The specialists' main takeaway is not about the technique but about the shift in context. According to AllSecure co-founder Christian Papathanasiou, North Korean operations are usually associated with fake job openings and the recruitment of developers, but here the same logic surfaced in ordinary web browsing. This doesn't retire the old playbook — it broadens the threat model.

Source: The Hacker News