DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily

The article describes a DPRK-linked macOS malvertising campaign that uses sponsored search results and fake full-screen macOS update pages to trick users into pasting clipboard-loaded commands into Terminal, installing a backdoor that fetches payloads including a crypto-focused infostealer and a malicious Chrome extension targeting 157 cryptocurrency wallets and cloud credentials.[1][5][6][8] This is part of the long-running Contagious Interview cluster (UNC5342) and leverages EtherHiding to resolve command-and-control infrastructure from Ethereum smart contracts.[1][6][8] From a RealGround perspective, the campaign highlights how advanced threat actors combine social engineering, browser extensions, and cloud key theft to enable large-scale cryptocurrency and data compromise, which could be replicated or augmented by AI-driven tooling. Organizations using AI agents in browser or terminal workflows should subject those agents to continuous red teaming to test resilience against ClickFix-style clipboard and command abuse, and engage AI CISO advisory support to integrate these evolving macOS and crypto-focused threats into broader AI security governance and incident response planning