Lazarus Group Unveils MachO Man macOS Malware Campaign

Security researchers have identified a new macOS malware campaign linked to North Korea's Lazarus Group, targeting executives in the cryptocurrency and financial technology sectors. The operation, known as MachO Man, uses sophisticated social engineering to infiltrate Apple systems and steal sensitive data, with initial reports emerging in late March 2025.

The attack begins with urgent messages sent via Telegram, posing as invitations to video conferences from trusted contacts or partners. Victims are directed to counterfeit websites mimicking platforms like Zoom, Microsoft Teams, or Google Meet. These sites instruct users to paste a command into their Mac's Terminal application to resolve a fabricated connection issue. Once executed, the command downloads and runs the MachO Man payload, a modular kit of native MachO binaries that grants attackers immediate remote access to the infected device and connected corporate networks.

According to Mauro Eldritch, founder of blockchain intelligence firm BCA, the malware then extracts valuable information, including browser credentials, cookies, Keychain entries, and cryptocurrency wallet data. It archives the stolen details into a zip...