North Korean Actors Target macOS Users With Fake Update Malware

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that redirects users to counterfeit web pages displaying a full‑screen non-existent update sequence before delivering crypto‑stealing malware as part of a new iteration of the long‑running Contagious Interview family.¹

The defining aspect of the attack is a bogus macOS software update screen that tricks users into believing they are downloading official updates from Apple. Once the page loads, the malicious payload installs without prompting for permission, allowing it to harvest cryptocurrency wallet addresses and exfiltrate sensitive data. The campaign also incorporates obfuscation techniques that can confuse even experienced reverse engineers when evaluating initial code samples alone, highlighting challenges faced by researchers in identifying new threats.¹

Expert analysis notes that the Contagious Interview family has persisted since at least 2017, initially targeting Windows systems with fake job postings. The sophistication here lies in mimicking legitimate Apple software update flows; attackers likely leveraged stolen or leaked digital signatures to bypass certificate validation on user machines—a tactic seen previously by APT41 using compromised Microsoft certificates back in early 2021.

Given these findings, security specialists recommend verifying certificate validity before accepting any update prompts. Users should download updates directly from Apple's official channels rather than clicking links within emails or browser windows, ensuring only trusted signatures are accepted. Enabling Gatekeeper and notarization checks on macOS devices adds an extra layer of defense against counterfeit installer screens.

Continued vigilance, coupled with routine verification of software sources, remains essential for protecting privacy and preventing crypto‑stealing malware infections among macOS users.