DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

Malvertising / Cryptocurrency Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily copies an attack command to the clipboard and then prompts the victim to execute it via the Terminal app, a known technique referred to as ClickFix. "The experience is designed to induce panic," AllSecure said in a report shared with The Hacker News. "The computer appears frozen or rebooting, so a user who believes the OS has failed follows instructions they would otherwise find suspicious." The campaign is also noteworthy for its use of blockchain-hosted command-and-control (C2), with the malware extracting the live server address from an Ethereum smart contract. This takedown-resistant approach, referred to as EtherHiding, has been put to use by North Korean threat actors in prior campaigns associated with Contagious Interview (aka UNC5342). The end goal of the attacks is to facilitate remote code execution, allowing the implant to poll the C2 server and fetch two additional payloads, an information stealer capable of targeting 157 cryptocurrency wallets and a malicious Chrome extension. The attack chain is a departure from typical Contagious Interview campaigns in that the starting point involves clicking on a search result for an unspecified target company. As soon as the website opens, the browser displays the full-screen macOS reboot message, giving the impression that a software update was underway, while stealthily setting the stage for the next phase of the infection. Once the fake update sequence completes, the fake page prompts the user to open the Terminal app and paste an already copied command into the system's clipboard. Interestingly, any attempts to reproduce this sequence do not yield the same result, meaning the activation is intended to be single-use. What's interesting here is that the initial lure was not a suspicious job offer, a video assessment, or a coding test, all of which have been various methods the Contagious Interview cluster has employed in the past. Instead, it begins with a seemingly harmless web search. In the case observed by AllSecure, the victim is said to have been searching for electrophoresis machines and clicked on a sponsored result for a company that appeared to sell them. The infection sequence begins immediately after the fake page loads on their browser. The command pasted into Terminal is a curl command designed to fetch the next-stage malware, leading to the execution of a Node.js backdoor that uses a LaunchAgent for persistence and calls an Ethereum contract to resolve the C2 server address. The implant is configured to check in with the server every five minutes and execute any JavaScript code returned by it. The EtherHiding mechanism serves as a conduit for two payloads - An information stealer that harvests data from web browsers (Chrome, Brave, Edge, Firefox, Opera, and Vivaldi), 157 cryptocurrency wallets, as well as SSH, AWS, Azure, and npm keys A malicious "Google Drive Offline" extension that's sideloaded into the browser by patching Chrome's Secure Preferences file and is used to drain a victim's wallet. Two Ethereum addresses are embedded into the malware, both acting as EtherHiding configuration responsible for fetching the actual C2 servers: "rg-telemetry[.]sbs/api" and "th-updates[.]sbs/analytics." "Each contract was created by a throwaway wallet running an identical four-step script: funded with ~0.0126 ETH, deploy the contract, write the config, forward the leftover ~0.006 ETH onward, then abandon the wallet," AllSecure said. "The pattern suggests an operator that has industrialised deployment: fund, deploy, configure, drain leftovers, abandon, repeat." Further analysis has determined that both the backdoor and the browser-extension drainer are funded from the same wallet cluster, indicating that the activity is the work of a single actor. "The delivery context is also worth noting: DPRK-linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario," Christian Papathanasiou, co-founder and CEO of AllSecure, said. "That does not replace the fake-job pattern; it expands the threat model." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.