Lazarus Group Intensifies Threat with Mach-O Man Attack, Warns CertiK

Security experts have sounded the alarm over the North Korean state-sponsored Lazarus Group's latest campaign, dubbed 'Mach-O Man', which leverages everyday business communications to orchestrate credential theft and data breaches. According to Natalie Newson, a senior blockchain security researcher at CertiK, the group has set its sights on high-value targets in the fintech and cryptocurrency sectors, with estimated cumulative losses exceeding $6.7 billion since 2017. The past two weeks have seen the group siphon off over $500 million from the Drift and KelpDAO exploits, underscoring the urgency of the threat. Newson emphasized that the crypto industry must acknowledge Lazarus as a persistent and well-funded menace, rather than merely a news headline. The group's heightened activity level, coupled with the emergence of a new macOS malware kit, has raised concerns about the scale and speed of their state-directed financial operations. The Mach-O Man campaign utilizes a modular macOS malware kit, created by Lazarus' Chollima division, which employs native Mach-O binaries tailored for Apple environments. This malware kit is delivered via a social engineering technique known as ClickFix, where victims are tricked into pasting a command into their terminal to resolve a simulated connection issue. The attack begins with an 'urgent' meeting invite sent to executives over Telegram, redirecting them to a convincing but fake website that instructs them to copy and paste a command to 'fix a connection issue'. By doing so, victims inadvertently grant immediate access to corporate systems, SaaS platforms, and financial resources. The malware's ability to erase itself after a successful breach often leaves victims unaware of the security breach until it's too late. With several variations of this attack already identified, security researchers warn that the threat posed by Lazarus Group is more pronounced than ever, and that the crypto industry must adopt a more vigilant approach to counter this menace.