North Korean ROOFDECK Backdoor Uses Nostr Profiles to Hide Malware C2 Servers
North Korea-linked threat actor TraderTraitor has expanded its macOS malware campaign beyond cryptocurrency firms, targeting an Indian IT services provider through fake job interview...
MacSync macOS Stealer Exploits ClickFix Lures to Steal Credentials and Cryptocurrency Wallets
MacSync, a macOS-focused information stealer and remote-access stager sold through a malware-as-a-service (MaaS) model, is targeting Apple users through ClickFix lures, search-engine malvertising, and...
DPRK-Linked Hackers Use Trojanized macOS Installers to Deploy OtterCookie RAT
DPRK-linked threat actors are using fake macOS installers to deliver the OtterCookie remote access trojan (RAT) in an expansion of the long-running Contagious Interview...
Fake OpenAI Codex Installer Tricks Mac Users Into Pasting Malware Into Terminal
Threat actors are abusing fake OpenAI Codex download pages to trick macOS users into running malware through Terminal.
The campaign uses ClickFix, a social-engineering...
MacSync Stealer Uses Stable URI Patterns and Chunked HTTP PUT Across Rotating C2 Domains
MacSync Stealer is a macOS-focused information stealer that uses rapidly changing command-and-control (C2) domains to deliver payloads, communicate with infected devices, and steal data....