North Korea's 'Contagious Interview' Campaign Targets Mac Users with Fake Installers and OtterCookie RAT
North Korean threat actors are distributing 14 fake macOS installers, disguised as popular applications, to deliver the OtterCookie remote-access trojan as part of the 'Contagious Interview' campaign.
North Korean threat actors have escalated their 'Contagious Interview' campaign by distributing 14 fake macOS installers, masquerading as legitimate applications, to deliver the OtterCookie remote-access trojan (RAT). This campaign, previously known for targeting developers and job seekers with malicious code disguised as coding tests or repositories, has now expanded its attack vectors to include trojanized software installers. The attackers are leveraging macOS disk image (.DMG) and installer package (.PKG) files to hide malware, aiming to compromise systems used by developers and individuals seeking employment.
The OtterCookie RAT, the final payload in this operation, is designed to steal sensitive credentials from browsers and cryptocurrency wallets, search for critical files on the victim's system, and monitor clipboard data. The malware employs a staged download process, with a Socket.IO component facilitating communication with command-and-control (C2) servers. This sophisticated approach allows attackers to maintain a covert presence and exfiltrate valuable data without immediate detection.
Jamf Threat Labs identified this cluster of fake installers and linked its associated staging infrastructure to previous attacks involving malicious Git hooks and Visual Studio Code task files. The campaign's success hinges on social engineering, tricking users into bypassing macOS security warnings. Once executed, the malware can operate in the background, retrieving subsequent stages of the payload while a decoy application appears to launch normally, creating a deceptive user experience.
The 14 impersonated applications include popular tools such as The Unarchiver, Presentify, PDFify, Magic Disk Cleaner, Sketch, SiteSucker Pro, and others. Researchers noted that these installers lack valid signatures and notarization, a key indicator of malicious intent. In DMG attacks, attackers modify the application bundle to run a hidden executable named .macos upon user interaction, which then contacts a staging server and removes the quarantine attribute from the legitimate application before launching it as a decoy.
The installer package (.PKG) route employs a different mechanism, utilizing preinstall and postinstall scripts to deploy the malware. These scripts fetch subsequent stages of the payload and attempt to clear security flags from the installed application. Notably, the hidden executable is built for Intel processors, requiring Rosetta 2 to run on Apple Silicon Macs, a detail that aligns with previous observations of x86-64 macOS malware designed with Rosetta 2 in mind.
The infection chain begins with a downloaded script that creates a hidden ~/.task folder and retrieves tokenlinux.sh. This is followed by the download of Node.js, a malicious parser.js file, and other components. The final program is launched, and subsequent communication with C2 servers uses short-lived signed tokens, likely for session tracking and access control. The OtterCookie RAT's capabilities, including its credential stealing and data exfiltration functions, are consistent with previous OtterCookie variants found hidden within SVGs targeting developers.
This campaign underscores the importance of user vigilance and robust security practices. Security teams are advised to treat unsolicited interview software as potential security incidents, especially when users are asked to disable security features or install packages outside of official channels. Organizations should ensure threat prevention, advanced detection, and web controls are enabled to block and report such activities. Users are strongly encouraged to obtain software only from trusted sources, verify developer signatures, and avoid disabling security protections for unfamiliar applications.
The continued use of job-related lures and familiar application names highlights the adaptability of North Korean threat actors. This campaign serves as a stark reminder that social engineering tactics, combined with increasingly sophisticated malware delivery mechanisms, pose a persistent threat to macOS users, particularly within the developer community and among job seekers.