Mac users are being targeted with a new wave of fake installer packages that masquerade as legitimate apps but actually deliver a dangerous remote-access trojan (RAT) known as OtterCookie. These impostor installers pose as familiar macOS software and are leveraged in the long-running “Contagious Interview” campaign, where attackers pretend to be recruiters and send coding tests or repos to potential job applicants.
How the Attack Works
Fourteen disguised installers have been identified, using both disk-image (DMG) and package (PKG) formats. Unlike properly signed apps, none of these have valid developer signatures or notarization. When a DMG version is opened, the payload hides a malicious executable named “.macos” inside what appears to be a legitimate app bundle. That executable removes the macOS quarantine flag, launches the decoy app, then quietly reaches out to a staging server. On the PKG side, attackers make use of preinstall and postinstall scripts to plant the RAT components under Application Support and activate them, respectively. Because OtterCookie is built for Intel (x86-64), it relies on Rosetta 2 to run on Apple-silicon Macs.
Malicious Payload and Broader Implications
OtterCookie is a full-featured RAT that can steal browser and cryptocurrency wallet credentials, scan files in memory, collect clipboard contents, and discreetly gather sensitive data. Attackers employ a multi-stage delivery process: after initial installation, a hidden folder is created in the user’s home directory (“~/.task“), followed by shell scripts that load Node.js, fetch a payload script parser.js, and then finally activate the RAT. Staged access is controlled using signed tokens, likely to restrict unauthorized observers from proceeding to later phases.
The campaign revives strategies seen in previous “recruitment malware” operations, but diverges by using installer packages instead of just coding assignments and Git hooks. The bait remains recognizable Mac utilities, including names like The Unarchiver, Sketch, Bartender, and Magic Disk Cleaner, making the lure more convincing. Indicators of compromise (IoCs) tied to this attack include a number of IPs, domains, and file hashes associated with the staging and command-and-control (C2) infrastructure.
Protection Strategies
Users should only download software from trusted sources, verify that apps are signed and notarized by Apple, avoid disabling the quarantine attribute or bypassing Gatekeeper warnings, and never run unfamiliar terminal commands stemming from unsolicited job offers. Organizations—especially those hiring externally or involving applicants in take-home projects—should treat these requests as potential threats, ensure threat prevention tools are in place, and monitor code and package deliveries carefully.
This campaign underscores the need for vigilance not just from developers, but from anyone receiving unvetted software. Even routine warnings from macOS should be taken seriously as possible signs of malware, rather than mere annoyances.
What this means: Whether you’re a job candidate or developer, these tactics show attackers are refining how they breach macOS defense layers. Watch for unexpected installers bearing familiar names, unsigned apps, and prompts to disable security features. Prevention and detection need to extend beyond code review—a holistic approach that considers installer supply chains and user behavior could be the difference between safe systems and severe data compromise.
