North Korean hackers have been caught running a clever new malvertising scheme that tricks Mac users into infecting their own machines by posing as system updates. Security researchers at AllSecure say the campaign is the latest twist in a long-running operation known as Contagious Interview, which has previously relied on fake job offers and coding tests to lure victims. This time, however, the attackers are casting a much wider net by hijacking search results and redirecting users to convincing fake update screens that quietly copy malicious commands to their clipboards.
The attack begins innocuously enough, with a victim searching for something mundane like laboratory equipment and clicking on what looks like a legitimate sponsored result. Once the page loads, the browser takes over the full screen with what appears to be a macOS reboot sequence. The display is designed to induce panic, making users believe their operating system has frozen or crashed. When the fake update finishes, the page instructs them to open Terminal and paste an already-copied command, which then fetches and installs a Node.js backdoor that persists on the machine through a LaunchAgent.
What makes this campaign particularly hard to shut down is its use of blockchain technology for command-and-control infrastructure. The malware retrieves live server addresses from Ethereum smart contracts, a technique dubbed EtherHiding that North Korean operators have used before. Researchers found that disposable wallets fund each contract with roughly 0.0126 ETH, deploy it, write configuration data, forward leftover funds elsewhere, and then abandon the wallet entirely. AllSecure described this as an industrialized process that makes takedowns nearly impossible since new contracts can be spun up automatically.
Once embedded on a compromised machine, the backdoor checks in with its command server every five minutes and pulls down two additional payloads designed to strip cryptocurrency from the victim. The first is an aggressive information stealer capable of harvesting data from six major browsers along with credentials for 157 different crypto wallets and cloud service keys from AWS, Azure, SSH, and npm. The second payload is a malicious browser extension disguised as Google Drive Offline functionality that sideloads itself into Chrome by patching security files specifically to drain wallet funds.
Christian Papathanasiou, co-founder and CEO of AllSecure, noted that this case significantly broadens the threat model typically associated with North Korean cyber operations. While most reporting has focused on elaborate recruitment ruses targeting developers, the same operational logic is now appearing in everyday browsing scenarios where anyone searching the web could stumble into a trap. The discovery suggests these threat actors are adapting their playbook beyond specialized social engineering toward mass exploitation tactics that could ensnare far more victims than targeted interview schemes ever could.
