Trojanized macOS Installers Deliver OtterCookie Malware in Contagious Interview Campaign
Summary
Jamf analyzed 14 unsigned macOS installers linked to Contagious Interview. The installers fetch staged scripts and OtterCookie, which can enable remote access, steal credentials, scan files, and capture clipboard contents.
Key points
- The 14 samples impersonate known Mac applications and were found as both DMG images and PKG installers.
- DMG samples use a hidden executable and PKG samples run a staged preinstall script; both fetch the first-stage script from 162.0.239.85.
- The unsigned installers are blocked by Gatekeeper by default; launching them requires removing the quarantine attribute.
- The delivery chain stages scripts in a hidden directory and downloads Node.js and the final parser.js payload.
- The final payload is OtterCookie, with remote-access, browser and crypto-wallet credential-stealing, file-scanning, and clipboard-collection components.
- The article links the activity to the broader Contagious Interview campaign, which it says is attributed to North Korea; the samples may indicate testing or early development.
Article Details
- Attack Vectors
- Trojanized DMG and PKG installers impersonate known macOS applications. The modified app launches a hidden, unsigned .macos executable; the PKG installs and runs a staged preinstall script.
- The scripts retrieve successive stages from attacker infrastructure, download Node.js and a malicious parser.js, then execute the parser payload.
- The installers are distributed in the context of a fake job interview and take-home assignment, consistent with previously reported Contagious Interview delivery methods.
- Defensive Notes
- The trojanized applications and PKGs are unsigned; Gatekeeper blocks the app, and the PKG will not execute without removal of the quarantine attribute. Do not remove quarantine to run untrusted installers.
- Monitor for unexpected hidden .macos executables in application bundles, altered CFBundleExecutable values, quarantine removal, and scripts or packages staged under ~/.task or /Library/Application Support/*Extra.
- Jamf recommends configuring threat prevention, advanced threat controls, and web protection to Block and Report.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 147[.]124[.]202[.]205 | Separate OtterCookie operator server, reported to use ports 7671, 7676, and 7679. |
| IPV4 | 162[.]0[.]239[.]85 | Staging and payload-delivery server used by the trojanized installers; the article reports payload-chain traffic over port 3000. |
MITRE ATT&CK
T1005 · Data from Local SystemOtterCookie scans the in-memory filesystem for selected file extensions and sensitive files.T1059.004 · Unix ShellThe delivery chain uses bash and shell scripts, including /task/mac and tokenlinux.sh, to retrieve and run later stages.T1059.007 · JavaScriptThe final parser.js payload is run using Node.js.T1105 · Ingress Tool TransferThe scripts download successive stages, including /task/mac, tokenlinux.sh, parser.js, and package.json, from staging infrastructure.T1115 · Clipboard DataOtterCookie regularly runs pbpaste to retrieve clipboard contents.T1204.002 · Malicious FileVictims are induced to launch trojanized application bundles or installer packages as part of a fake interview or take-home assignment.T1555.003 · Credentials from Web BrowsersOtterCookie includes a browser credential stealer.
People
Threat Actors
Malware
Products
GatekeeperDue to the lack of a valid code signature and notarization, the trojanized application will be blocked by Gatekeeper.macOSJamf Threat Labs identified a cluster of macOS disk images (DMG) and installer packages (PKG) impersonating known Mac applications. Every sample in the cluster reaches out to the same staging infrastructure, matching aNode.jsand trusting a project results in a background bash command piping a remote JavaScript payload into Node.js. In May, our friends at OpenSourceMalware documented the same operators moving the loader intoRosetta 2Running the file command reveals that .macos is compiled for Intel only, which means Rosetta 2 must be installed before the application can launch.
Tools
BunsterFurther analysis revealed that the .macos binary is a shell script that has been converted to Go code and then compiled as a standalone Go executable via the open-source project, Bunster.Mac MonitorThese malicious actions can be seen by using an endpoint security monitoring tool such as Mac Monitor: