North Korea Hits macOS with Fake Updates and a Backdoor That Empties Crypto Wallets

Security researchers detected a malicious campaign targeting macOS users on July 30, 2026. The operation combines malvertising, fake system updates, and social engineering to install a backdoor that steals credentials and empties cryptocurrency wallets. The attack is attributed to North Korean actors and represents an evolution of the “Contagious Interview” campaign (tracked as UNC5342).

From Sponsored Search to Terminal Command

The trigger is not the usual fake job ad but a sponsored result on search engines. The observed lure advertises electrophoresis machinery, but the scheme can vary. Clicking lands the user on a full‑screen page that simulates a macOS restart or update. The screen is designed to induce panic. In the background, a script copies a curl command to the clipboard and asks the user to paste it into Terminal to complete the operation. This technique, called ClickFix, exploits psychological pressure: the victim voluntarily runs the command, which downloads and executes a Node.js backdoor.

Persistence, Blockchain C2, and Malicious Payload

The backdoor achieves persistence via a LaunchAgent and contacts the command-and-control server by querying an Ethereum contract. This method (EtherHiding) hides the C2 addresses on the blockchain, making traffic difficult to filter. Two C2 domains were registered: rg-telemetry[.]sbs/api and th-updates[.]sbs/analytics.

After establishing a foothold, the malware downloads two payloads:

• Info‑stealer: extracts credentials from Chrome, Brave, Edge, Firefox, Opera, and Vivaldi; steals SSH keys, AWS, Azure, and npm tokens; and plunders over 157 cryptocurrency wallets.
• Malicious Chrome extension (“Google Drive Offline”): it is force‑loaded by modifying the browser’s Secure Preferences file and includes a direct function to drain linked wallets.

The theft is immediate and does not require manual exfiltration of keys.

Single‑Shot Attack and Industrial Patterns

The attack is one‑off: repeating the sequence from the same system or IP does not yield the same result. The operator uses disposable Ethereum wallets with an industrial approach: it funds the contract, deploys it, sets the configuration, drains the residual funds, and abandons everything. This behavior, together with previously known indicators of compromise, solidifies the attribution to North Korea, which uses cryptocurrency theft as a primary source of funding.

How to Defend Yourself

• Never run commands pasted into Terminal after a purported system update. Official updates come through System Settings or the App Store.
• Block malvertising with ad‑blockers and DNS filtering, and limit clicks on sponsored results.
• Monitor LaunchAgents (e.g., com.apple.mac.update.plist) and check for suspicious changes to browser Secure Preferences files.
• Check known IoCs at the network level, such as the domains rg-telemetry[.]sbs and th-updates[.]sbs.
• Maintain offline backups and enable multi‑factor authentication on all cloud services and critical accounts.