A recent cyber campaign linked to North Korean threat actors has been identified, employing deceptive macOS update prompts to distribute malware. This operation specifically targets cryptocurrency wallets, browser data, and developer credentials, transforming routine web activities into potential security threats.
The attack initiates with a browser-based lure that simulates a frozen or rebooting Mac system. Victims are prompted to open the Terminal application and execute a command pre-copied to their clipboard by the malicious webpage, thereby commencing the infection process.
Security researchers from AllSecure uncovered this activity during an investigation into a malvertising incident associated with standard online searches. The tactics observed align with those previously attributed to North Korean-affiliated groups, notably UNC5342 and the ‘Contagious Interview’ campaign. However, this method extends beyond traditional fake job offers and developer recruitment schemes.
Technical Details of the ‘EtherHiding’ Technique
Upon execution of the provided command, the malware installs Node.js and deploys an obfuscated remote access trojan (RAT). Unlike conventional malware that relies on static command-and-control (C2) servers, this RAT utilizes Ethereum smart contracts to dynamically retrieve C2 information—a technique referred to as ‘EtherHiding.’ This approach complicates mitigation efforts, as the smart contract serves as a resilient configuration layer, allowing attackers to modify their infrastructure without altering the malware on infected systems.
The RAT communicates with the C2 server approximately every five minutes, executing JavaScript commands supplied by the attackers. It establishes persistence through various methods, including LaunchAgent entries, modifications to shell profiles, and concealed files within cache directories, ensuring the malware remains active after system reboots. Researchers identified two Ethereum smart contracts embedded within the malware, which, while devoid of cryptocurrency balances, direct infected devices to separate infrastructures for the RAT and a malicious browser extension.
Data Exfiltration and Browser Extension Deployment
Following successful infiltration, the malware deploys an information stealer designed to extract data from 157 cryptocurrency wallets. Additionally, it collects saved browser passwords, cookies, browsing history, bookmarks, SSH keys, cloud service credentials, npm configuration files, and Foundry keystores, potentially exposing development environments.
The campaign also surreptitiously installs a malicious Chrome extension masquerading as ‘Google Drive Offline.’ This extension requests extensive permissions, including browser debugging, cookie access, native messaging, and access to all URLs, providing a persistent mechanism for monitoring or controlling browser activities.
The focus on developers amplifies the risk beyond the immediate theft of cryptocurrency assets. Compromised cloud keys, source control credentials, and browser sessions could grant attackers access to corporate infrastructures, mirroring previous North Korean campaigns that targeted developers and sensitive project data.
Financial analysis reveals the scale of this operation. AllSecure tracked 464.80 ETH, valued at approximately $890,000, transferred into the attackers’ treasury through 281 transactions between late May and July 2026. This substantial sum underscores the effectiveness and reach of the campaign.
This development highlights the evolving sophistication of state-sponsored cyber threats. The use of blockchain technologies for C2 communication exemplifies the innovative tactics employed to evade detection and maintain persistence. Organizations, particularly those in the cryptocurrency and software development sectors, must remain vigilant, implementing robust security measures and educating personnel about such deceptive tactics to mitigate potential risks.
