North Korean Hackers Develop Malware Evading Apple Security

According to Cointelegraph, North Korean hackers have reportedly developed malware capable of bypassing Apple's security checks. Researchers from Jamf Threat Labs identified these experimental apps, which target Apple's macOS operating system. This marks the first instance of such technology being used against macOS, although it does not affect systems that are up-to-date. The researchers discovered apps with malicious intent that were mistakenly identified as safe by Microsoft's VirusTotal online scanning service. These apps were found in variants written in Go and Python and utilized the Google Flutter app, an open-source developer kit for creating multi-platform applications. Notably, five out of six of these malicious apps had developer account signatures and were temporarily notarized by Apple. The researchers noted that the domains and techniques used in the malware closely resemble those associated with other North Korean malware, suggesting that the malware was once signed and even temporarily passed Apple's notarization process. The researchers expressed uncertainty about whether the malware has been used against any targets or if it is part of preparations for a new form of delivery. They speculated that it might be in the testing phase for further weaponization. The malware carried names related to cryptocurrency, such as New Updates in Crypto Exchange, New Era for Stablecoins and DeFi, CeFi, and Multisig Risks in Stablecoin and Crypto Assets, indicating the hackers' potential targets. When executed, the app named New Updates in Crypto Exchange opened a modified version of the minesweeper game. North Korean hackers are known for their resourcefulness and have previously exploited vulnerabilities in other platforms. In October, they were caught exploiting a Chrome vulnerability to steal crypto wallet credentials. Allegations also surfaced that North Koreans were involved in developing the Cosmos network Liquid Staking Module. These hackers are reportedly highly organized, allegedly generating hundreds of thousands of dollars in cryptocurrency monthly and amassing approximately $3 billion over the past six years, according to the United Nations.