North Korean Hackers Deploy RustDoor and Koi Stealer to Target Cryptocurrency Developers on macOS

Summary: A recent report from Unit 42 reveals a new campaign of cyberattacks linked to North Korea, targeting macOS users, particularly in the cryptocurrency sector. The malware RustDoor and Koi Stealer are designed to exfiltrate sensitive data while evading detection through macOS-specific techniques, often luring victims with fake job offers. Evidence suggests these attacks are carried out by a subgroup of the Lazarus Group, known for targeting the financial sector to support North Korea’s illicit activities.

Affected: Cryptocurrency industry and macOS users

Keypoints :

• Campaign tracked as CL-STA-240, named Contagious Interview, involves sophisticated malware RustDoor and Koi Stealer.
• Attackers employ social engineering tactics, posing as recruiters to entice developers into downloading malware disguised as legitimate updates.
• RustDoor executes in multiple stages, including establishing persistence and stealing sensitive user data, while Koi Stealer uses AppleScript to evade detection.
• Malware steals data such as cryptocurrency wallet information, browser credentials, and potentially enables lateral movement within networks.
• Connections drawn between this campaign and previous cyber operations attributed to the North Korean threat actor, BlueNoroff of the Lazarus Group.