DPRK-linked threat actors are using fake macOS installers to deliver the OtterCookie remote access trojan (RAT) in an expansion of the long-running Contagious Interview campaign.
Jamf Threat Labs found 14 malicious DMG and PKG files impersonating popular Mac applications, including The Unarchiver, Presentify, PDFify, Magic Disk Cleaner, Sketch, SiteSucker Pro, Mole, Bartender, Disk Doctor Pro, and Mp3tag.
The campaign is linked to earlier attacks that used fake job-interview assignments, malicious Git hooks, and Visual Studio Code task files.
The attackers target people who may download and run software as part of a coding test, job application, or developer-related task.
Instead of relying only on infected project repositories, the operators are now disguising their malware as legitimate macOS applications.
DPRK Trojanizes macOS Installers
The malicious DMG files contain an altered version of a real-looking application. Inside the application bundle, attackers add a hidden executable named .macos.
They also modify the app’s Info.plist configuration so macOS launches the hidden file when the victim opens the application.
The hidden program first removes the quarantine attribute from the legitimate-looking app and launches it as a decoy. This lets victims see the expected application while malicious activity runs in the background.
The malware then contacts a staging server at 162.0.239[.]85 over port 3000 and downloads a script named /task/mac. The first-stage script creates a hidden directory, ~/.task, and retrieves another shell script called tokenlinux.sh.
The PKG installer variant uses a similar approach. It installs the visible application into the /Applications directory, but also drops a malicious preinstall script under /Library/Application Support/<appname>Extra.
A post-installation script launches that hidden payload and begins the same download chain.
Both DMG and PKG samples were unsigned. macOS Gatekeeper should block unsigned and unnotarized applications by default.
However, the attack can succeed if a victim manually bypasses security warnings or removes the file’s quarantine protection.
Researchers noted that the malware is compiled for Intel-based Macs. Apple Silicon systems would need Rosetta 2 installed for the malicious executable to run.
The final-stage script downloads an official Node.js package, a malicious parser.js file, and a package.json file. It then runs npm install and executes the JavaScript payload.
Researchers identified parser.js as OtterCookie, a malware family previously associated with Contagious Interview operations. OtterCookie includes a Socket.IO-based RAT component that enables attackers to communicate with infected machines.
The malware also contains modules designed to steal browser data and cryptocurrency-wallet credentials. It can scan files in memory for sensitive documents and specific extensions.
Another component repeatedly uses the macOS pbpaste command to capture clipboard content, potentially exposing copied passwords, wallet addresses, recovery phrases, and confidential text, Jamf said.
The staging infrastructure uses signed, short-lived JSON Web Tokens in later download requests.
These tokens contain details such as the victim’s source IP address, session identifier, timestamp, and campaign step. This design may help operators track victims and control payload delivery.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
 in an expansion of the long){kind=link}