Onyx

Apple

Tornado Cash

Tornado

<div class="sg-post-des">
 The social engineering attacks trick community members into downloading a malicious ZIP archive named ‘Cross-platform Bridges.zip’ — imitating an arbitrage bot designed for automated profit generation.
</div>
<div class="cointelegraph">
 A new <a rel="noopener noreferrer nofollow" title="malware" href="https://thebittimes.com/tag/malware.html">malware</a> discovered on Apple’s macOS — tied to the North Korean hacking group Lazarus — has reportedly <a rel="noopener noreferrer nofollow" title="target" href="https://thebittimes.com/tag/target.html">target</a>ed blockchain <a rel="noopener noreferrer nofollow" title="engineers" href="https://thebittimes.com/tag/engineers.html">engineers</a> of a cryptocurrency exchange platform.
 The macOS malware “KandyKorn” is a stealthy backdoor capable of data retrieval, directory listing, file upload/download, secure deletion, process termination, and command execution, according to an analysis by Elastic Security Labs.
 <figure><img src="https://cdn.thebittimes.com/images/2023/11/03/d32d83af074db0e4af97fdf16788eccd.webp">
 <figcaption style="text-align: center;">MacOS malweare (REF7001) execution flow. Source: elastic.co
 </figcaption>
 </figure>
 The above flowchart explains the steps taken by the malware to infect and hijack users’ computers. Initially, the attackers spread Python-based modules via Discord channels by impersonating members of the community.
 The social engineering attacks trick <a rel="noopener noreferrer nofollow" title="community" href="https://thebittimes.com/tag/community.html">community</a> members into downloading a malicious ZIP archive named ‘Cross-platform Bridges.zip’ — imitating an arbitrage bot designed for automated profit generation. However, the file imports 13 malicious modules that work together to steal and manipulate information. The report read:
 <blockquote>
 “We observed the threat actor adopting a technique we have not previously seen them use to achieve persistence on macOS, known as execution flow hijacking.”
 </blockquote>
 The cryptocurrency sector remains a primary target for Lazarus, primarily motivated by financial gain rather than espionage, their other main operational focus.
 The existence of KandyKorn underscores that macOS is well within Lazarus’ <a rel="noopener noreferrer nofollow" title="target" href="https://thebittimes.com/tag/target.html">target</a>ing range, showcasing the threat group’s remarkable ability to craft sophisticated and inconspicuous <a rel="noopener noreferrer nofollow" title="malware" href="https://thebittimes.com/tag/malware.html">malware</a> tailored for Apple computers.
 Related: Onyx Protocol exploiter begins siphoning $2.1M loot on Tornado Cash
 A recent exploit on Unibot, a popular Telegram bot used to snipe trades on the decentralized exchange Uniswap, crashed the token's price by 40% in one hour.
 <blockquote class="twitter-tweet">
 .@TeamUnibot seems exploited, the exploiter transfers memecooins from #unibot users and is exchanging them for the $ETH right now. The current exploit size is ~$560K Exploiter address:https://t.co/ysyTmgUAit pic.twitter.com/MF85Fdk892— Scopescan ( . ) (@0xScopescan) October 31, 2023
 </blockquote>
 Blockchain analytics firm Scopescan alerted Unibot users about an ongoing hack, which was later confirmed by an official source:
 <blockquote>
 “We experienced a token approval exploit from our new router and have paused our router to contain the issue.”
 </blockquote>
 Unibot committed to compensating all users who lost funds due to the contract exploit.
 Magazine: Slumdog billionaire 2: ‘Top 10… brings no satisfaction’ says Polygon’s Sandeep Nailwal
 <template data-name="subscription_form" data-type="markets_outlook"></template>
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/apple-macos-malware-targets-crypto-community-and-engineers-tbt68937.html">https://thebittimes.com/apple-macos-malware-targets-crypto-community-and-engineers-tbt68937.html</a>

Apple MacOS malware targets crypto community and engineers

TheBitTimes

Other articles published on Nov 3, 2023

ADA Price Analysis: New Supply Warns Sharp Correction In ADA!

HBAR Price Analysis: Shakeout For HBAR Buyers With Pullback!

This Chainlink Metric Just Hit Meteoric Levels – Good News For LINK Price?

Avalanche (AVAX) Price Soars as CEO Resigns from Stars Arena Project

2024 Crypto Currency Predictions: What Do the Top 5 Predictions Tell Us?

$308 Million Crypto Fraud:19 Chinese Nationals Caught

Join our free newsletter for daily crypto updates!