DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

Summary

North Korea-linked threat actors are conducting a sophisticated macOS malvertising campaign, part of the Contagious Interview operation, using fake software update screens to trick users into executing malware. This campaign employs a technique called ClickFix, where a command is copied to the clipboard and users are prompted to run it in the Terminal. The malware utilizes blockchain-hosted C2 servers via Ethereum smart contracts for takedown resistance, aiming to steal cryptocurrency and browser data.

Full text

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware Ravie LakshmananJul 30, 2026Malvertising / Cryptocurrency Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily copies an attack command to the clipboard and then prompts the victim to execute it via the Terminal app, a known technique referred to as ClickFix. "The experience is designed to induce panic," AllSecure said in a report shared with The Hacker News. "The computer appears frozen or rebooting, so a user who believes the OS has failed follows instructions they would otherwise find suspicious." The campaign is also noteworthy for its use of blockchain-hosted command-and-control (C2), with the malware extracting the live server address from an Ethereum smart contract. This takedown-resistant approach, referred to as EtherHiding, has been put to use by North Korean threat actors in prior campaigns associated with Contagious Interview (aka UNC5342). The end goal of the attacks is to facilitate remote code execution, allowing the implant to poll the C2 server and fetch two additional payloads, an information stealer capable of targeting 157 cryptocurrency wallets and a malicious Chrome extension. The attack chain is a departure from typical Contagious Interview campaigns in that the starting point involves clicking on a search result for an unspecified target company. As soon as the website opens, the browser displays the full-screen macOS reboot message, giving the impression that a software update was underway, while stealthily setting the stage for the next phase of the infection. Once the fake update sequence completes, the fake page prompts the user to open the Terminal app and paste an already copied command into the system's clipboard. Interestingly, any attempts to reproduce this sequence do not yield the same result, meaning the activation is intended to be single-use. What's interesting here is that the initial lure was not a suspicious job offer, a video assessment, or a coding test, all of which have been various methods the Contagious Interview cluster has employed in the past. Instead, it begins with a seemingly harmless web search. In the case observed by AllSecure, the victim is said to have been searching for electrophoresis machines and clicked on a sponsored result for a company that appeared to sell them. The infection sequence begins immediately after the fake page loads on their browser. The command pasted into Terminal is a curl command designed to fetch the next-stage malware, leading to the execution of a Node.js backdoor that uses a LaunchAgent for persistence and calls an Ethereum contract to resolve the C2 server address. The implant is configured to check in with the server every five minutes and execute any JavaScript code returned by it. The EtherHiding mechanism serves as a conduit for two payloads - An information stealer that harvests data from web browsers (Chrome, Brave, Edge, Firefox, Opera, and Vivaldi), 157 cryptocurrency wallets, as well as SSH, AWS, Azure, and npm keys A malicious "Google Drive Offline" extension that's sideloaded into the browser by patching Chrome's Secure Preferences file and is used to drain a victim's wallet. Two Ethereum addresses are embedded into the malware, both acting as EtherHiding configuration responsible for fetching the actual C2 servers: "rg-telemetry[.]sbs/api" and "th-updates[.]sbs/analytics." "Each contract was created by a throwaway wallet running an identical four-step script: funded with ~0.0126 ETH, deploy the contract, write the config, forward the leftover ~0.006 ETH onward, then abandon the wallet," AllSecure said. "The pattern suggests an operator that has industrialised deployment: fund, deploy, configure, drain leftovers, abandon, repeat." Further analysis has determined that both the backdoor and the browser-extension drainer are funded from the same wallet cluster, indicating that the activity is the work of a single actor. "The delivery context is also worth noting: DPRK-linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario," Christian Papathanasiou, co-founder and CEO of AllSecure, said. "That does not replace the fake-job pattern; it expands the threat model." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  browser security, Cloud security, cryptocurrency, MacOS, malvertising, Malware, Social Engineering, Threat Intelligence, Web Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• domain — rg-telemetry.sbs
• domain — th-updates.sbs
• malware — Contagious Interview
• mitre_attack — T1059.003
• mitre_attack — T1547.001
• mitre_attack — T1071.001

Entities