Mac users hunting for everyday utilities are the newest quarry in a long-running North Korean hacking campaign that has traditionally aimed its lures at software developers.
Researchers at Jamf Threat Labs found a group of malicious disk images and installers masquerading as popular Mac software: The Unarchiver, Bartender, Mp3tag, Sketch, Presentify, Disk Doctor Pro and more. Every sample in the group calls the same staging servers that back Contagious Interview, the fake-job scheme attributed to North Korea and tracked by researchers throughout 2026.
The counterfeit apps arrive unsigned. Inside each disk image, the bundle’s Info.plist points macOS at a hidden .macos file instead of the real binary, so a double-click runs attacker code rather than the genuine program. The PKG variants stage a script into a hidden folder and use a postinstall hook to strip the quarantine attribute before handing control to it.
That opening script pulls a second stage from a hardcoded server address, which writes a shell file into the hidden ~/.task directory and fetches an official Node.js build from nodejs.org. The final payload is OtterCookie, a socket-based remote access trojan bundled with a browser and crypto wallet credential stealer, an in-memory file sweeper and a clipboard clipper that runs pbpaste on a timer.
Against earlier Contagious Interview samples, staging has moved into a hidden directory, retrieval URLs now carry short-lived signed tokens, and the downloader dropped its Apple silicon check so it requests only the Intel build, quietly making Rosetta 2 a requirement. The booby-trapped packages won’t execute on their own, hinting the operators may still be fine-tuning the delivery. Jamf advises downloading software only from official sources and treating unsigned apps as suspect.
