{"id":65359,"date":"2026-07-31T02:56:00","date_gmt":"2026-07-31T06:56:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=65359"},"modified":"2026-07-31T02:56:00","modified_gmt":"2026-07-31T06:56:00","slug":"dprk-macos-malvertising-clickfix","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/dprk-macos-malvertising-clickfix\/","title":{"rendered":"DPRK macOS Malvertising Drops Crypto-Stealing Malware via ClickFix"},"content":{"rendered":"

A sophisticated macOS malvertising campaign linked to North Korean threat actors has been deploying cryptocurrency-stealing malware through a deceptive ClickFix<\/a> technique that simulates a full-screen operating system update. The attack, identified as a new variant of the long-running Contagious Interview campaign, leverages blockchain-hosted command-and-control infrastructure to evade takedown and ultimately targets over 157 cryptocurrency wallets<\/a> alongside browser credentials and cloud service keys. The campaign marks a significant evolution in the operational tactics of the Democratic People’s Republic of Korea (DPRK) threat cluster, expanding beyond fake job interviews and coding assessments into broader web search scenarios.<\/p>\n

The Attack Chain: From Sponsored Search Results to Full-Screen Deception<\/h2>\n

The infection sequence begins with a seemingly innocuous action: clicking on a sponsored search result. In the case analyzed by cybersecurity firm AllSecure, the victim was searching for electrophoresis machines and clicked on a paid advertisement for a company that appeared to sell them. Once the fake website loaded in the browser, however, the page immediately displayed a full-screen macOS reboot message, giving the impression that a software update was already underway. This visual trick is designed to induce panic by making the computer appear frozen or rebooting, prompting the user to follow instructions they would otherwise find suspicious.<\/p>\n

This delivery method represents a departure from typical Contagious Interview campaigns, which have historically relied on fake job offers, video assessments, or coding tests to lure targets. Instead, the attackers integrated the malvertising lure into organic search behavior, demonstrating an expanded threat model that exploits everyday browsing habits. The fake update page is also engineered to be single-use: any attempt to reproduce the sequence does not yield the same result, suggesting that the activation is tied to a unique session or cookie to hinder analysis.<\/p>\n

How ClickFix Works in This Campaign<\/h3>\n

The key component of the attack is a well-known technique called ClickFix. While the fake macOS update sequence is displayed, the page stealthily copies a malicious command to the victim’s clipboard. The page then prompts the user to open the Terminal app and paste the command. The command itself is a curl request designed to fetch the next-stage malware from a remote server. The psychological pressure of a frozen computer makes the victim more likely to comply without scrutinizing the pasted content.<\/p>\n

What is ClickFix? It is a social engineering method that tricks users into executing malicious code by making them believe they are fixing a system issue. In this campaign, the fake update screen induces urgency and panic, exploiting the user’s trust in the operating system’s update mechanism and their desire to restore normal function. The command is executed in the Terminal, which grants the malware full system access.<\/p>\n

EtherHiding: Blockchain-Based Command-and-Control Evasion<\/h2>\n

The malvertising campaign is notable for its use of Ethereum smart contracts to store live command-and-control (C2) server addresses. This takedown-resistant approach, known as EtherHiding, has been previously employed by North Korean threat actors in the Contagious Interview cluster (also tracked as UNC5342). Instead of relying on traditional hosted domains that can be seized, the malware extracts the C2 address directly from an Ethereum contract. The Node.js backdoor deployed on the victim’s system calls the contract periodically to resolve the current server endpoint.<\/p>\n

AllSecure’s analysis identified two Ethereum addresses embedded in the malware, both acting as EtherHiding configuration contracts. These contracts returned the actual C2 domains used for communication: “rg-telemetry.sbs\/api” and “th-updates.sbs\/analytics.” The backdoor is configured to check in with the server every five minutes and execute any JavaScript code returned by it, enabling the attackers to maintain persistent remote access.<\/p>\n

Industrialized Blockchain Deployment<\/h3>\n

The attackers appear to have automated the deployment of these contracts. AllSecure observed that each contract was created by a throwaway wallet using an identical four-step script: fund the wallet with approximately 0.0126 ETH, deploy the contract, write the configuration, forward the leftover approximately 0.006 ETH onward, and abandon the wallet. This pattern indicates an operator that has industrialized the deployment process—fund, deploy, configure, drain leftovers, abandon, and repeat. The consistency suggests a scripted workflow that allows rapid creation of new C2 infrastructure without manual intervention.<\/p>\n

Two Final Payloads: A Cryptocurrency Stealer and a Chrome Extension Drainer<\/h2>\n

Once the Node.js backdoor establishes communication with the C2 server, it fetches two additional payloads. The first is an information stealer that harvests data from web browsers (including Chrome, Brave, Edge, Firefox, Opera, and Vivaldi), 157 cryptocurrency wallets, as well as SSH, AWS, Azure, and npm keys. The breadth of targeted wallets indicates a primary focus on cryptocurrency theft, but the inclusion of cloud and development credentials suggests a broader espionage or financial motive.<\/p>\n

The second payload is a malicious Chrome extension named “Google<\/a> Drive Offline.” This extension is sideloaded into the browser by patching Chrome’s Secure Preferences file, a technique previously documented in other North Korean campaigns. Once installed, the extension is used to drain the victim’s cryptocurrency wallets by intercepting transactions or directly extracting private keys. The extension’s innocuous name helps it blend in among legitimate extensions, reducing suspicion.<\/p>\n