DPRK on macOS: ClickFix, EtherHiding and 157 targeted wallets

AllSecure researchers have documented a macOS campaign combining malvertising, a full-screen fake update, ClickFix social engineering and command-and-control resolution through an Ethereum smart contract. The final payloads steal browser, cloud and developer credentials and target 157 cryptocurrency wallets.

The activity has been attributed to North Korea-linked operators associated with Contagious Interview. This time, however, the opening does not resemble recruitment or a coding test. A victim reaches the malicious page through a sponsored search result. The threat model expands from “a suspicious repository sent by a recruiter” to ordinary web browsing.

How the infection unfolds

AllSecure’s research and the documented technical chain describe these stages:

1. A user clicks an advertisement or sponsored result leading to a fake corporate site.
2. The page enters full screen and displays a simulated macOS reboot and update.
3. JavaScript silently copies a command to the clipboard. After the “failed update,” the page instructs the user to open Terminal and paste it.
4. The curl command retrieves a later stage that launches a Node.js backdoor.
5. Malware creates a LaunchAgent for persistence and queries an Ethereum smart contract for the current C2 address.
6. It polls every five minutes and can execute JavaScript returned by the server.
7. The operator deploys an infostealer and a malicious extension impersonating “Google Drive Offline.”

The observed victim was searching for electrophoresis equipment. This matters defensively: the lure did not need to mention cryptocurrency or Web3 employment. The advertisement fit a normal user task.

ClickFix bypasses “did you download a suspicious file?”

ClickFix persuades the user to execute the command. The page does not need a macOS vulnerability. It creates a credible crisis — the machine appears frozen or mid-reboot — and then offers a “repair.” The command is already waiting in the clipboard, leaving only a short set of instructions to follow.

Traditional advice to avoid attachments and download updates only from trusted websites is insufficient. Employees must know that an operating system does not ask them to paste a command from an arbitrary web page into Terminal. Any such instruction should be stopped and reported.

EtherHiding does not store the entire malware on-chain

Here the smart contract acts as a takedown-resistant address book. The backdoor reads contract data to obtain the current C2 server. The operator can update configuration on-chain without shipping a new implant containing another domain.

Researchers found two contracts created through a repeatable workflow: fund a wallet with a small amount of ETH, deploy the contract, write configuration, forward the remainder and abandon the wallet. The pattern suggests industrialised infrastructure. Ethereum traffic by itself is not evidence of infection, however; legitimate applications use RPC and blockchain explorers. Detection must correlate the process, domain, LaunchAgent and subsequent communications.

What the final payloads steal

The infostealer covers Chrome, Brave, Edge, Firefox, Opera and Vivaldi, along with 157 wallet extensions or applications. It also searches for SSH, AWS, Azure and npm credentials. A developer workstation therefore becomes an entry point into the software supply chain and cloud, not merely a source of a personal wallet.

The second payload impersonates “Google Drive Offline.” It is side-loaded by modifying Chrome’s Secure Preferences file and is designed to drain wallets. Shared funding between the backdoor and extension infrastructure was one of the signals connecting the activity into one cluster.

Detection and response on macOS

Teams should hunt for combinations of behaviour:

• Terminal or a shell starting shortly after a browser enters full-screen mode;
• curl or another downloader launched by a user without an associated administration task;
• a new .plist under LaunchAgents starting Node.js or a file from a user-controlled directory;
• a Node.js process making periodic connections at roughly five-minute intervals;
• Ethereum contract reads from a process with no business reason to use blockchain services;
• changes to Chrome Secure Preferences and forced loading of an unapproved extension;
• rapid access to multiple browser stores, wallets, .ssh, AWS/Azure configuration and npm credentials.

When detected, isolate the host but preserve memory and LaunchAgent files. From a clean device, revoke browser sessions, SSH keys, cloud credentials and npm tokens. Assess wallets separately and, if private keys may have been read, move assets to new keys generated on a clean device. Inspect repositories and cloud logs for use of stolen credentials.

Risk reduction

• restrict interactive Terminal use on managed devices where it is unnecessary;
• enforce an approved browser-extension list and monitor preference files;
• filter advertising and newly registered domains on corporate endpoints;
• use MDM, EDR and LaunchAgent controls;
• separate cryptocurrency operations from everyday browsing by identity and device;
• prefer short-lived cloud credentials and hardware confirmation for high-value operations.

We covered the earlier recruitment pattern in our article on fake recruitment and JXA malware on macOS. The new campaign does not replace it; it adds an advertising route and a simulated system failure.

Primary facts versus Breachroad analysis

The infection chain, payload types, polling interval and contract traces come from AllSecure’s analysis. DPRK attribution is based on infrastructure, funding and alignment with Contagious Interview tradecraft; it does not identify an individual operator. The report describes an observed case rather than measuring the campaign’s full scale.

Breachroad’s conclusion is to extend ClickFix defence beyond fake CAPTCHAs to advertising, update prompts and macOS users. Cybersecurity training and phishing simulations can rehearse this pressure, while an IT security audit can assess MDM, EDR, extensions, developer secrets and response readiness.