DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware 与朝鲜关联的macOS恶意广告利用虚假更新交付加密窃取恶意软件

TL;DR

• North Korean threat actors have launched a sophisticated macOS malvertising campaign using fake update screens to trick users into executing malicious commands via Terminal (ClickFix technique).
• The campaign leverages blockchain-hosted command-and-control (C2) through Ethereum smart contracts (EtherHiding), making it takedown-resistant and dynamically configurable.
• The attack chain begins with a seemingly legitimate web search result, bypassing traditional social engineering lures like fake job offers, expanding the threat model beyond prior Contagious Interview tactics.
• Two payloads are delivered: an information stealer targeting 157 cryptocurrency wallets and browser data, and a malicious Chrome extension ("Google Drive Offline") designed to drain funds.
• The malware uses a Node.js backdoor with LaunchAgent persistence, checks in every five minutes for JavaScript instructions, and is funded from a single wallet cluster, indicating coordinated, industrialized operations.

Why It Matters

This campaign represents a significant evolution in state-sponsored cyber espionage by shifting from targeted recruitment-based attacks to broad-spectrum malvertising that exploits user trust in standard browsing behavior. For AI practitioners and security researchers, it highlights how adversarial techniques are increasingly blending psychological manipulation with decentralized infrastructure, challenging traditional detection models. Understanding these hybrid attack vectors is critical for developing robust defense systems capable of identifying subtle behavioral anomalies in real-time.

Technical Details

• Attack Vector: Malvertising via sponsored search results leads to a full-screen fake macOS update page that simulates system freeze/reboot to induce panic and compliance.
• ClickFix Technique: The malicious command is silently copied to the clipboard during the fake update sequence; victims are prompted to paste it into Terminal, which executes a curl command to fetch the next-stage payload.
• EtherHiding C2: The malware queries two Ethereum smart contracts hosted at rg-telemetry[.]sbs/api and th-updates[.]sbs/analytics to retrieve live C2 server addresses, enabling dynamic reconfiguration without code changes.
• Payload Delivery: After initial infection, the Node.js backdoor pulls two additional components: (1) a multi-browser crypto-stealer supporting Chrome, Brave, Edge, Firefox, Opera, Vivaldi, plus SSH/AWS/Azure/npm keys; (2) a malicious Chrome extension installed by patching Secure Preferences to intercept wallet transactions.
• Persistence & Execution: Uses macOS LaunchAgent for persistence, polls C2 every 5 minutes for remote JavaScript execution, and employs throwaway Ethereum wallets with automated deployment scripts (fund → deploy → configure → drain → abandon).

Industry Insight

Security teams must expand threat monitoring beyond known phishing or recruitment-based campaigns to include malvertising-driven supply-chain compromises where attackers exploit organic search behavior. Organizations should implement strict endpoint controls around Terminal usage and monitor for anomalous clipboard activity or unexpected LaunchAgent registrations. Additionally, integrating blockchain analytics into threat intelligence platforms can help detect EtherHiding patterns early by tracking contract deployment behaviors and wallet clustering indicative of coordinated state actor infrastructure.

TL;DR

• 朝鲜关联攻击者利用虚假macOS更新页面诱导用户执行终端命令，窃取加密货币。
• 攻击链通过以太坊智能合约（EtherHiding）实现去中心化C2通信，提升抗取证能力。
• 初始诱饵从传统“假招聘”转向普通搜索结果广告，扩大攻击面与目标群体。
• 恶意载荷包含信息窃取器与伪装成“Google Drive Offline”的浏览器扩展，针对157种加密钱包。
• 攻击呈现工业化部署特征：使用一次性钱包自动部署合约并转移剩余资金后废弃。

为什么值得看

本文揭示了朝鲜黑客组织Contagious Interview在攻击手法上的显著演进——从定向社会工程转向广撒网式malvertising，结合区块链技术与自动化部署流程，极大提升了隐蔽性与持续性。对安全从业者而言，理解此类跨平台、跨媒介的新型攻击路径有助于构建更全面的威胁检测与响应体系。

技术解析

• ClickFix机制：伪造全屏macOS更新界面制造系统崩溃假象，静默将curl命令写入剪贴板，诱导用户在Terminal中粘贴执行，利用心理恐慌绕过警惕性。
• EtherHiding C2架构：恶意Node.js backdoor定期轮询以太坊智能合约获取真实C2服务器地址（如rg-telemetry[.]sbs/api），合约由一次性钱包按固定脚本自动创建、配置、清空后丢弃，难以追踪或封堵。
• 双 payload 投递：植入物加载信息窃取器（支持Chrome/Brave等主流浏览器及SSH/AWS密钥提取）和恶意Chrome扩展（篡改Secure Preferences文件注入“Google Drive Offline”扩展以盗取钱包私钥）。
• 单触发特性：整个更新模拟过程仅对首次访问有效，重复加载不再现相同行为，防止分析复现。
• 持久化与控制：通过LaunchAgent确保开机自启，每5分钟连接C2接收并执行任意JavaScript代码，实现动态控制与远程指令下发。

行业启示

• 攻击媒介泛化趋势明显：传统针对开发者的钓鱼场景正被通用网络浏览行为取代，企业需加强对第三方广告渠道与搜索引擎结果的监控与过滤。
• 区块链成为新型基础设施武器化载体：EtherHiding模式表明攻击者开始滥用去中心化技术规避制裁与封禁，安全团队应建立针对智能合约异常调用与资金流动的监测规则。
• 自动化攻击流水线成熟化：从合约生成到资金清理的全流程标准化操作显示国家级APT组织已具备工业级攻击生产能力，防御体系必须向主动狩猎与行为分析转型。