North Korea's Lazarus Group Launches macOS Malware Attack

On April 22, the North Korean hacker organization Lazarus Group initiated a new macOS attack campaign named “Mach-O Man,” targeting executives and institutions in high-value sectors such as cryptocurrency and fintech. The attack employs a social engineering technique called “ClickFix,” which entices victims to paste commands on their Mac terminals to gain access to corporate systems, SaaS platforms, and financial resources. CertiK researchers noted that “Mach-O Man” is a modular macOS malware toolkit developed by Lazarus Group, which has now been adopted by other cybercriminal groups and often self-deletes before victims can detect it, complicating traceability and detection efforts. Additionally, attackers have implemented this attack by hijacking DeFi project domains and replacing them with fake Cloudflare messages.