[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_BXa1mAVTQOgJk7YIxXHzlNvt_AGE7Ucpl3v40pF2Ks":3},{"article":4,"iocs":54,"watch_terms":73,"solutions":74,"lesson":169},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"358c1526-f5ad-4b61-a283-12e8f4fa378d","DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware","dprk-linked-macos-malvertising-uses-fake-updates-to-deliver-crypto-stealing-malw-e63683","Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily","North Korea-linked threat actors are conducting a sophisticated macOS malvertising campaign, part of the Contagious Interview operation, using fake software update screens to trick users into executing malware. This campaign employs a technique called ClickFix, where a command is copied to the clipboard and users are prompted to run it in the Terminal. The malware utilizes blockchain-hosted C2 servers via Ethereum smart contracts for takedown resistance, aiming to steal cryptocurrency and browser data.","DPRK-linked threat actors use malvertising to deliver crypto-stealing malware on macOS via fake updates.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fdprk-linked-macos-malvertising-uses.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhCHbm6QCC9jjGwa-7P1N2PwhDjRvpC2hlS2hl09-DUZa5xdDeHt9qH1zISepl2ERqDzmDbdQ_zfE2vkHDsvE7G8QsetJHjzC45DpPr5-83lc1BGaLHfEwMfdYEA04d5xc7GL02_qkz1HjhIenSKBWF0FZqHnICaLn9agLEoEGnnN2n-smXxYFuQQaYNd8A\u002Fs1600\u002Fall-secure.jpg","2026-07-30T18:18:24+00:00","2026-07-30T20:00:19.018989+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"DPRK","threat_actor",{"name":21,"type":22},"Contagious Interview","campaign",{"name":24,"type":25},"macOS","product",{"name":27,"type":28},"Ethereum","technology",{"name":30,"type":25},"Chrome","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61,63,67,70],{"type":56,"value":57,"context":58},"domain","rg-telemetry.sbs","C2 server domain for malware communication",{"type":56,"value":60,"context":58},"th-updates.sbs",{"type":48,"value":21,"context":62},"Name of the ongoing malware campaign",{"type":64,"value":65,"context":66},"mitre_attack","T1059.003","Command and Scripting Interpreter: Windows Command Shell (used via Terminal on macOS)",{"type":64,"value":68,"context":69},"T1547.001","Boot or Logon Autostart Execution: Registry Run Keys \u002F Startup Folder (Persistence via LaunchAgent)",{"type":64,"value":71,"context":72},"T1071.001","Application Layer Protocol: Web Protocols (used for C2 communication)",[24,30],{"controls":75,"vendors":157},[76,105,134],{"slug":77,"name":78,"problem":79,"products":80},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":106,"name":107,"problem":108,"products":109},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"slug":135,"name":136,"problem":137,"products":138},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[139,146,152],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":140,"product_name":143,"url":144,"description":145},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":147,"product_name":148,"url":150,"description":151},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":153,"product_name":154,"url":155,"description":156},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[158,164],{"slug":159,"name":160,"logo_path":161,"roles":162},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[163],"affected",{"slug":165,"name":166,"logo_path":167,"roles":168},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[163],{"slug":170,"title":171,"body":172,"framework_refs":173,"framework_notes":187},"dprk-clickfix-campaign-tricks-macos-users-into-self-executing-crypto-stealing-malware","DPRK ClickFix Campaign Tricks macOS Users into Self-Executing Crypto-Stealing Malware","North Korea-linked threat actors are exploiting a fundamental gap in user security awareness by disguising malware delivery as routine software update prompts — a technique known as ClickFix. By tricking users into manually pasting and executing malicious Terminal commands, attackers bypass many automated defenses and place the execution responsibility on the victim. The use of Ethereum smart contracts for command-and-control infrastructure makes takedown efforts significantly harder for defenders and law enforcement. This campaign highlights how social engineering combined with decentralized infrastructure can outmaneuver traditional security controls, putting cryptocurrency wallets and browser-stored credentials at serious risk.",[174,175,176,177,178,179,180,181,182,183,184,185,186],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 5: Account Management","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF DE.CM-1: Network Monitoring","MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1566: Phishing \u002F Social Engineering","MITRE ATT&CK T1071: Application Layer Protocol (C2 via Blockchain)",{}]