DPRK-Linked macOS Campaign Uses Fake Updates and EtherHiding to Target Crypto Wallets
Summary
AllSecure reports a Contagious Interview campaign that uses fake macOS updates and clipboard abuse to install a Node.js backdoor, an information stealer targeting 157 crypto wallets, and a malicious Chrome extension.
Key points
- AllSecure attributes the campaign to North Korea-linked actors and associates it with Contagious Interview, also known as UNC5342.
- Malicious sponsored search results lead to a fake full-screen macOS update page that copies a command to the clipboard and tells users to run it in Terminal.
- The command fetches a Node.js backdoor that persists through a LaunchAgent, checks in every five minutes, and can execute JavaScript returned by its C2 server.
- The backdoor uses Ethereum smart contracts to retrieve C2 details, a technique the article identifies as EtherHiding.
- The information stealer targets 157 cryptocurrency wallets, browser data, and SSH, AWS, Azure, and npm credentials.
- A sideloaded “Google Drive Offline” Chrome extension patches Chrome’s Secure Preferences file and is used to drain victims’ wallets.
- AllSecure says shared funding from the same wallet cluster links the backdoor and browser-extension drainer to one actor.
Article Details
- Attack Vectors
- Malicious sponsored search results redirected macOS users to a fake full-screen update page.
- The fake page copied a command to the clipboard and instructed victims to paste it into Terminal; the command used curl to retrieve the next-stage malware.
- A Node.js backdoor used a LaunchAgent for persistence, resolved C2 addresses through Ethereum smart contracts, checked in every five minutes, and executed JavaScript returned by the server.
- An information stealer collected data from browsers, cryptocurrency wallets, and SSH, AWS, Azure, and npm credentials.
- A malicious Chrome extension was sideloaded by patching Chrome's Secure Preferences file and used to drain victims' wallets.
MITRE ATT&CK
T1059.004 · Unix ShellVictims were instructed to execute the attacker's curl command in macOS Terminal.T1059.007 · JavaScriptThe backdoor executed JavaScript code returned by its C2 server.T1105 · Ingress Tool TransferThe curl command retrieved the next-stage malware.T1176 · Software ExtensionsThe malicious Chrome extension was sideloaded by patching Chrome's Secure Preferences file.T1204.004 · Malicious Copy and PasteThe fake update page copied a command to the clipboard and persuaded victims to paste and run it.T1543.001 · Launch AgentThe Node.js backdoor used a LaunchAgent for persistence.
People
Threat Actors
Contagious InterviewThe campaign is described as tied to Contagious Interview; the article attributes it to North Korea-linked threat actors.UNC5342The article identifies UNC5342 as an aka for Contagious Interview, which it says the campaign is tied to; the activity is attributed to North Korea-linked threat actors.
Products
Google ChromeThe campaign, tied to Contagious Interview and EtherHiding, delivers a Node.js backdoor, an info stealer, and a malicious Chrome extension targeting cryptocurrency wallets and cloud credentials.macOSNorth Korea-linked threat actors launched a macOS malvertising campaign that uses a fake full-screen update page and ClickFix-style clipboard abuse to trick victims into running malicious Terminal commands.