Security researchers at AllSecure have documented a macOS attack chain that combines browser-based fake update screens with blockchain-hosted command infrastructure to steal cryptocurrency from Mac users.
The operation, tracked as part of the North Korean Contagious Interview campaign (UNC5342), triggers when a victim clicks on a sponsored search result – observed in one case for laboratory electrophoresis equipment. The browser immediately renders a full-screen overlay mimicking a macOS reboot sequence.
Once the fake update animation finishes, the page silently copies a curl command to the clipboard and displays instructions telling the user to open Terminal and paste the command. Unlike traditional malware that executes automatically, this approach relies on human action – a social engineering technique commonly called ClickFix.
The command downloads a Node.js backdoor that survives reboots through a LaunchAgent. Rather than using a conventional C2 server, the malware resolves its command-and-control address through an Ethereum smart contract, making the infrastructure resistant to takedown. Researchers observed the backdoor polling the contract every five minutes for new instructions and executing returned JavaScript payloads.
AllSecure’s analysis traced two final payloads from the operation: a cryptocurrency stealer capable of draining 157 different wallet types and a Chrome extension designed to intercept browser transactions. Both payloads receive funding from the same wallet cluster, pointing to a single operator.
The shift from targeted job-interview lures to broad malvertising marks a notable escalation. “This case shows the same operational logic appearing in a broader browsing scenario,” said AllSecure co-founder Christian Papathanasiou. Each infection trigger uses a unique session key, making the fake update page non-replayable from the same source.
