Apple

Security

Discord

A new Apple macOS malware, named “KandyKorn,” has been discovered, and it’s associated with the notorious North Korean hacking group, Lazarus. This malware has been specifically designed to target blockchain engineers working for cryptocurrency exchange platforms. KandyKorn malware targets Crypto professionals 
KandyKorn is a covert malware that can do various things like stealing data, listing directories, transferring files, deleting securely, stopping processes, and running commands.Elastic Security Labs conducted a thorough analysis to understand how this malware gets into users’ computers. 
The attackers behind KandyKorn initially distributed Python-based modules through Discord channels, posing as community members. They used social engineering tactics to deceive community members into downloading a malicious ZIP archive named “Cross-platform Bridges.zip.”&nbsp; Source: Elastic security lab 
This file pretended to be a money-making bot but, when opened, it secretly imported 13 bad parts that stole and messed with sensitive data. How KandyKorn spread among Crypto communities? 
The report from Elastic Security Labs highlights a previously unseen technique employed by the threat actors known as “execution flow hijacking,” which enables the malware to maintain persistence on macOS. Lazarus Group’s financial motives in the Crypto industry 
Lazarus, the<a href="https://news.todayq.com/un-urges-members-to-take-action-against-north-korea-for-its-1-billion-theft-in-crypto/" rel="noopener noreferrer nofollow"> North Korean hacking group</a> behind KandyKorn, is mostly focused on making money in the cryptocurrency field. They do some other stuff too, but their main goal is financial gain. KandyKorn’s existence highlights their skill in creating tricky malware for Apple computers.
Recently, a similar incident was reported by Todayq News on October 31, 2023, an <a href="https://news.todayq.com/unibot-suffers-560k-asset-theft-token-price-plummets-by-40/" rel="noopener noreferrer nofollow">exploit targeting Unibot</a>, a popular Telegram bot used for trading on the decentralized exchange Uniswap. Blockchain analytics firm Scopescan identified the ongoing hack and alerted Unibot users, which was later confirmed by an official source.
Related Article: <a href="https://news.todayq.com/north-korean-lazarus-groups-kandykorn-malware-strikes-crypto-exchanges/" rel="noopener noreferrer nofollow">North Korean Lazarus Group’s ‘Kandykorn’ malware strikes Crypto exchanges</a>
Unibot has taken responsibility for the situation and announced that they experienced a token approval exploit from their new router. As a response, they temporarily paused the router to contain the issue. Additionally, Unibot has committed to compensating all users who suffered financial losses due to the contract exploit.
This news shows that the cryptocurrency community faces growing cybersecurity challenges. Advanced malware like KandyKorn highlights the need for constant vigilance and strong security measures to protect digital assets and sensitive information in the crypto world.
© Todayq News

Report: Apple macOS malware targets blockchain engineers in Crypto

Todayq News

Other articles published on Nov 3, 2023

Days After Admitting Defeat, Bearish Analyst il Capo Speaks Again: “A Decline Below This Level Wo...

This Altcoin Season Signal is Flashing As it Did in 2021, But Why This Time is Different

Coinbase Effect Revealed in the Rise of Solana (SOL)! VanEck Report Predicts a Record Price for S...

How to Secure the Next $MEME Token Airdrop Through Farming

Top Crypto Analyst Predicts ‘Easy 100%’ Rally for AI-Focused Altcoin, Updates Outlook on Chainlink

FTX founder Sam Bankman-Fried found guilty in historic fraud case

Join our free newsletter for daily crypto updates!