DPRK-Linked Campaign Uses Malvertising and Blockchain C2 to Steal Cryptocurrency on macOS
North Korea-linked threat actors are employing a sophisticated malvertising campaign, dubbed Contagious Interview, to distribute macOS malware that steals cryptocurrency by leveraging blockchain for command and control.
A North Korea-linked threat actor has been identified orchestrating a sophisticated malvertising campaign targeting macOS users, continuing the long-running "Contagious Interview" operation. This latest iteration employs deceptive tactics, redirecting unsuspecting users to fake web pages that mimic full-screen software update sequences. The ultimate goal is to deliver cryptocurrency-stealing malware and facilitate remote code execution on compromised systems.
The attack chain begins with users clicking on seemingly legitimate search results, often for unspecified target companies. Upon loading the fake page, a full-screen macOS reboot message appears, designed to induce panic and trick users into believing their system is undergoing a critical update. This deceptive interface, however, is a carefully crafted lure to prompt the victim to execute a command copied to their clipboard via the Terminal application – a technique known as ClickFix.
Once the user pastes the command into Terminal, it initiates the download of a next-stage payload. This payload is a Node.js backdoor that establishes persistence using a LaunchAgent. A key innovation in this campaign is its use of blockchain technology for command-and-control (C2) infrastructure. The malware extracts the live server address from an Ethereum smart contract, a technique dubbed "EtherHiding," which makes the C2 infrastructure highly resistant to takedown efforts.
The EtherHiding mechanism is crucial for fetching two additional malicious payloads. The first is an information stealer designed to harvest sensitive data from 157 different cryptocurrency wallets, as well as credentials for various services like SSH, AWS, Azure, and npm. The second payload is a malicious Chrome extension, disguised as "Google Drive Offline," which is sideloaded into the browser and used to drain victim wallets.
The operational methodology behind the EtherHiding component is particularly noteworthy. Threat actors create Ethereum smart contracts using disposable wallets, fund them with a small amount of ETH, deploy the contract, write the configuration for the C2 servers, forward any remaining ETH, and then abandon the wallet. This industrialised deployment process suggests a highly organised and efficient operation.
This campaign represents an evolution in the Contagious Interview cluster's tactics. While previous iterations often relied on social engineering lures like fake job interviews or coding tests, this new approach broadens the threat model by initiating infections through general web searches. This expansion allows the threat actors to reach a wider range of potential victims beyond those actively seeking employment or engaging in developer-related activities.
Security researchers have confirmed that both the backdoor and the browser extension drainer originate from the same wallet cluster, strongly indicating that a single actor is behind this operation. The sophistication of the attack, combining malvertising, deceptive user interfaces, blockchain-based C2, and multi-stage payloads, highlights the persistent and evolving threat posed by North Korean-linked cybercriminal groups.