<\/p>\n
A new malware discovered on Apple\u2019s macOS \u2014 tied to the North Korean hacking group Lazarus \u2014 has reportedly targeted blockchain engineers of a cryptocurrency exchange platform.<\/p>\n
The macOS malware \u201cKandyKorn\u201d is a stealthy backdoor capable of data retrieval, directory listing, file upload\/download, secure deletion, process termination, and command execution, according<\/a> to an analysis by Elastic Security Labs. <\/p>\n The above flowchart explains the steps taken by the malware to infect and hijack users\u2019 computers. Initially, the attackers spread Python-based modules via Discord channels by impersonating members of the community. <\/p>\n The social engineering attacks trick community members into downloading a malicious ZIP archive named \u2018Cross-platform Bridges.zip\u2019 \u2014 imitating an arbitrage bot designed for automated profit generation. However, the file imports 13 malicious modules that work together to steal and manipulate information. The report read:<\/p>\n \u201cWe observed the threat actor adopting a technique we have not previously seen them use to achieve persistence on macOS, known as execution flow hijacking.\u201d<\/p><\/blockquote>\n The cryptocurrency sector remains a primary target for Lazarus, primarily motivated by financial gain rather than espionage, their other main operational focus.<\/p>\n The existence of KandyKorn underscores that macOS is well within Lazarus\u2019 targeting range, showcasing the threat group\u2019s remarkable ability to craft sophisticated and inconspicuous malware tailored for Apple computers.<\/p>\n Related: <\/em><\/strong>Onyx Protocol exploiter begins siphoning $2.1M loot on Tornado Cash<\/em><\/strong><\/a><\/p>\n A recent exploit on Unibot, a popular Telegram bot used to snipe trades on the decentralized exchange Uniswap, crashed the token’s price by 40% in one hour.<\/p>\n .@TeamUnibot<\/a> seems exploited, the exploiter transfers memecooins from #unibot<\/a> users and is exchanging them for the $ETH<\/a> right now.<\/p>\n The current exploit size is ~$560K<\/p>\n Exploiter address:https:\/\/t.co\/ysyTmgUAit<\/a> pic.twitter.com\/MF85Fdk892<\/a><\/p>\n\n