What went down

Short version: a clever malvertising trick tricks macOS users into running malware by pretending the computer is installing an update. Attackers (linked to North Korea) serve up a full-screen fake update page that looks like a legitimate macOS reboot/update sequence — except its a theatrical distraction. While youre freaking out and thinking your machine is fried, the page quietly copies an attack command into your clipboard and tells you to paste it into Terminal. If you do, you download a Node.js backdoor that hangs around as a LaunchAgent and phones home for instructions.

Researchers at AllSecure found the campaign starts from malvertising — often a sponsored search result — rather than the usual fake job-interview bait we’ve seen from this group before. The staged update only activates once: attempts to replay it dont reproduce the same clipboard copy, so its basically a one-shot scam triggered by your click.

How the infection works (and why its cheeky)

The chain is delightfully devious. The fake page copies a curl command to the clipboard and urges you to open Terminal and paste it. That curl pulls down and runs a Node.js implant which installs itself and checks in every few minutes. Instead of hard-coding a server address, the implant reads the live command-and-control location from an Ethereum smart contract — a takedown-resistant trick sometimes nicknamed blockchain C2.

Once active, the implant can fetch additional payloads. The observed secondary components include:

  • An information stealer that targets a slew of browsers and scrapes credentials, SSH/AWS/Azure/npm keys, and data from many crypto wallets (the report lists 157 wallet types).
  • A malicious browser extension disguised as a Google Drive offline helper that is sideloaded by modifying the browsers settings file to steal funds.

Operationally the attackers used throwaway Ethereum wallets to deploy small smart contracts containing the real C2 address, then drained the wallets and abandoned them — a repeatable script that looks like a factory assembly line: fund, deploy, configure, drain, repeat. Forensic links show both the backdoor and the extension money-stealer were paid from the same wallet cluster, which points to a single operator behind the activity.

How not to get played

Dont be the person who blindly pastes terminal commands from a web page. Thats the short and spicy rule. Here are practical steps (quick, actionable, and slightly bossy):

  • Never paste random commands into Terminal. If a webpage asks you to, close the tab and update macOS from System Settings or the App Store instead.
  • Be suspicious of full-screen “reboot” or “update” pages shown by a website. Legit updates come from the OS, not a random ad.
  • Prefer official vendor channels for downloads and updates. Dont trust sponsored search clicks for technical tools or specialist gear.
  • Lock down your browser: audit installed extensions regularly and remove anything you dont recognize.
  • Store large crypto holdings in hardware wallets; treat browser wallets like candy — easy to steal if left out.
  • Use endpoint protection and keep backups. If something odd happens, disconnect and get help instead of following on-screen panicked instructions.

This campaign swaps the old interview-lure script for a more general browsing trap, which means the threat model just widened. If youre googling niche lab gear or anything else and a sponsored result starts acting dramatic, remember: computers can look dramatic to fool you — but you dont have to play along.