North Korean Hackers Use Fake macOS Installers to Deliver RAT

Key Takeaways

• North Korean state-sponsored hackers are employing 14 distinct fake macOS application installers to distribute the OtterCookie remote-access trojan (RAT).
• The campaign, an extension of the “Contagious Interview” operation, targets Mac users, including developers and job seekers, with credential-stealing malware.
• The fake installers masquerade as popular macOS utilities like The Unarchiver, Sketch, and Bartender.
• OtterCookie is designed to exfiltrate browser and cryptocurrency wallet credentials, scan for sensitive files, and monitor clipboard data.
• Users are advised to download software exclusively from official sources and exercise extreme caution with unsolicited files, particularly those related to job applications.

North Korean state-sponsored threat actors are leveraging a new tactic to compromise macOS systems: distributing 14 counterfeit application installers that deliver a sophisticated credential-stealing remote-access trojan (RAT). This operation represents an evolution of the “Contagious Interview” campaign, traditionally focused on developers and job seekers.

The malicious files are packaged as macOS disk images (DMG) and installer packages (PKG), providing multiple vectors for attackers to infiltrate target systems. While previous iterations of the Contagious Interview campaign relied on lures embedded within developer workflows, this latest wave disguises the infection within seemingly legitimate software installers, broadening its potential reach.

Jamf Threat Labs identified this cluster of fraudulent installers and established a connection between its staging infrastructure and earlier attacks involving malicious Git hooks and Visual Studio Code task files. The ultimate payload deployed in these attacks is OtterCookie, a potent RAT capable of extracting sensitive information such as browser and cryptocurrency wallet credentials, identifying critical files, and monitoring clipboard activity.

The danger extends beyond simply downloading a single fake application. Should a victim override macOS security warnings, they could inadvertently launch a decoy application while the hidden malicious program operates in the background, retrieving subsequent stages of the attack. Jamf said in a report that this method grants attackers access to valuable account data and establishes a command-and-control channel on the compromised Mac.

Security teams are urged to treat any unsolicited software, particularly those presented as part of an interview process, as a potential security incident. This vigilance is especially critical when applicants are prompted to disable security features, execute terminal commands, or install packages from non-official distribution channels.

14 Fake macOS Installers Linked to DPRK Campaign

The 14 identified samples mimic widely used macOS applications, including The Unarchiver, Presentify, PDFify, Magic Disk Cleaner, Sketch, SiteSucker Pro, RAR Extractor Max, Mp3tag, Mole, HextEdit, Folder Preview Pro, Disk Doctor Pro, ServerCat, and Bartender.

Researchers discovered both DMG and PKG versions of these installers, none of which possessed valid digital signatures or Apple notarization. In the case of disk images, attackers modified the application configuration to execute a hidden executable named .macos when the user double-clicks the application bundle. This hidden process then removes the quarantine attribute from the genuine application, launches it as a decoy, and subsequently contacts a staging server. This technique mirrors prior malicious Git hook attacks that exploited job-related coding tasks to trigger malware deployment.

The package-based installers employ a different wrapping method but achieve the same malicious outcome. An unsigned installer places a preinstall script within the Application Support directory, which is then launched by a postinstall script. This script retrieves the next stage of the malware and attempts to remove the protection flag from the installed application. Notably, the hidden executable is compiled for Intel processors, necessitating Rosetta 2 for execution on Apple Silicon Macs. While researchers have previously documented x86-64 macOS malware delivery designed around Rosetta 2, this does not negate the requirement for user interaction in the current campaign.

Job Lures Expand Attack Chain

Upon initial download, the first script establishes a hidden ~/.task folder and fetches tokenlinux.sh. The subsequent script proceeds to download Node.js, a malicious parser.js file, and other supporting components. It then executes an installation command and launches the final program. Later retrieval requests are observed to carry short-lived signed tokens, likely designed to track the session and control access to each stage of the attack.

The OtterCookie RAT integrates a Socket.IO-based remote-access component, a dedicated browser and wallet credential stealer, an in-memory file scanner, and a clipboard data collector. Its deployment aligns with previous OtterCookie campaigns that targeted developers by embedding the RAT within seemingly legitimate SVG files.

Although some samples might represent active testing or early development stages, as they do not run by default, the combination of social engineering and multi-stage delivery underscores the critical importance of not dismissing security warnings as mere inconveniences. Users should always obtain Mac software from reputable sources, verify developer signatures where available, and never disable the quarantine attribute simply to run an unfamiliar application. This campaign, along with earlier fake interview malware, demonstrates the adaptability of recruitment-themed pretexts across various platforms and the continued effectiveness of using familiar Mac application names as bait.

What You Should Do

• Download Software from Trusted Sources: Only obtain macOS applications from the official App Store or directly from verified developer websites.
• Verify Developer Signatures: Always check for valid developer signatures on downloaded applications before installation.
• Do Not Bypass Security Warnings: Never override macOS Gatekeeper warnings or remove the quarantine attribute unless you are absolutely certain of the application’s legitimacy.
• Exercise Caution with Unsolicited Files: Be extremely wary of unexpected files, packages, or links received via email, messaging apps, or during online interactions, especially those related to job applications or professional opportunities.
• Enable Threat Prevention and Detection: Organizations should ensure robust threat prevention, advanced detection, and web filtering controls are active to block and report suspicious activity.
• Review External Code and Installers: Thoroughly review any repositories, package scripts, or installers, particularly when dealing with external code or during interview processes.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.