Mac users targetted by Lazarus ‘fileless’ Trojan

John E Dunn for Sophos:

The Lazarus hacking group has been caught trying to sneak a new ‘fileless’ Trojan on to Apple macOS computers disguised as a fake cryptocurrency trading application.

The discovery was reported by K7 Computing’s Dinesh Devadoss to Mac security expert Patrick Wardle, who immediately spotted similarities to previous attacks.

The first of these, from 2018, was the ‘Apple.Jeus’ malware, which also used a cryptocurrency trading application to lure high-value targets in order to steal cryptocoins.

In October 2019, the hackers retuned with a new backdoor Trojan that spreads using the same approach – a cryptocurrency application posted to GitHub for victims to download.

To make the applications appear trustworthy, both campaigns used the ruse of setting up fake software companies using legitimate certificates.

Both were connected to the suspected North Korean Lazarus Group, widely blamed for big attacks such as WannaCry in 2017 and Sony Pictures in 2014…

Cybercriminals are clearly targeting cryptocurrency in a big way. Any public application used to store or trade in this area should be treated with the extreme caution.

For Mac users, the threat now includes fileless techniques. However, while challenging, these are far from undetectable – Wardle’s KnockKnock tool is one way to spot the example discussed in this article.

MacDailyNews Take: Let’s be careful out there!


  1. “Wardle notes that for infection to occur, users would be ignoring at least two macOS warnings – that the installer is unsigned and a password prompt when the malware’s installer asks for root access.”

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.