DPRK-linked threat actors are exploiting Ethereum smart contracts as a resilient command-and-control (C2) infrastructure in a sophisticated macOS malware operation targeting crypto theft and developer credential compromise This article explores dprk linked threat. . Research by Christian Papathanasiou reveals that this campaign is attributed to the DPRK-associated UNC5342 cluster, known for its “Contagious Interview” style of activity.
The attack begins with a ClickFix-style browser lure: a full-screen fake macOS "update/reboot" page triggered via malvertising creates the illusion that the system has crashed, then instructs the user to open Terminal and paste a command that has already been silently copied to the clipboard.
Nothing is compromised until that command is executed, but once it is, a curl-and-pipe one-liner fetches a base64-encoded payload, installs Node.js if required, and launches an obfuscated Node.js remote access trojan (RAT) internally labeled as RAT v1.0.3. Once the backdoor is active, it silently deploys additional payloads: an infostealer module targeting 157 cryptocurrency wallets, browser secrets, and developer/cloud credentials, and a malicious Chrome extension masquerading as "Google Drive Offline" that sideloads by tampering with Chrome's Secure Preferences to appear trusted. The Chrome extension is built as an MV3 plugin with broad permissions including debugger, nativeMessaging, cookies, and access to all URLs, providing long-term visibility and control inside the victim's browser that can be driven from attacker-controlled web properties via externally connectable declarations.
