Lazarus group targets macOS users with counterfeit crypto job offers

The infamous Lazarus team makes headlines again as the North Korean cybercrime syndicate appeared to mimic occupation features from ‘Crypto.com’ to steal cryptocurrency and NFTs from unsuspecting users.

Back in August 2022, Lazarus impersonated Coinbase and promoted destructive task provides to IT personnel to unfold Windows and macOS malware.

The cybercrime team is now masquerading job features from Crypto.com. The ongoing phishing campaign, by significantly, targets macOS consumers. For each stories, the malware is identical to that found in faux Coinbase occupation postings. 

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Akin to earlier macOS strategies, the Lazarus group approached its targets by means of LinkedIn to ship a macOS binary masked as a PDF containing a 26-web site PDF file named ‘Crypto.com_Work_Opportunities_2022_confidential.pdf’ comprising counterfeit work vacancies at Crypto.com.

“Consistent with observations in the earlier campaign, this PDF is made with MS Word 2016, PDF edition 1.5. The document creator is stated as ‘UChan’,” confirmed Sentinel One in a report.

“The to start with stage malware opens the PDF decoy doc and wipes the Terminal’s existing savedState.”

“The second phase in the Crypto.com variant is a bare-bones application bundle named ‘WifiAnalyticsServ.app’ this mirrors the identical architecture noticed in the Coinbase variant, which made use of a next stage referred to as ‘FinderFontsUpdater.app’,” discussed Sentinel A single.

Nevertheless, inspite of the scope of the attack, Sentinel exposed Lazarus’ campaign is supposedly brief-termed as the binaries are devoid of any encryption.