14 Fake macOS Installers Linked to DPRK Campaign Deliver Credential-Stealing RAT

Mac users are being targeted with 14 fake application installers that appear to offer familiar software but instead start a credential-stealing remote-access trojan.

The files were distributed as macOS disk images and installer packages, giving attackers another route into systems used by developers and job seekers.

The activity is tied to the long-running Contagious Interview campaign, in which attackers pose as recruiters and send coding tests, repositories or packages to prospective candidates.

This latest wave moves the lure outside the usual developer workflow and hides the infection inside software installers.

Jamf Threat Labs identified the installer cluster and linked its staging infrastructure to earlier Git-hook and Visual Studio Code task-file attacks.

The final payload is OtterCookie, a remote-access trojan that can take browser and cryptocurrency-wallet credentials, search for sensitive files and monitor clipboard data.

The risk is not limited to a single fake download. A victim who bypasses macOS warnings can unknowingly launch a decoy application while the hidden program retrieves later stages in the background.

Jamf said in a report shared with Cyber Security News (CSN) that it gives operators a path to valuable account data and a channel for commands on the affected Mac.

Security teams should treat reports of unsolicited interview software as possible security incidents, especially when applicants are asked to disable safeguards, run terminal commands, or install a package outside normal distribution channels.

14 Fake macOS Installers Linked to DPRK Campaign

The 14 samples impersonate applications including The Unarchiver, Presentify, PDFify, Magic Disk Cleaner, Sketch, SiteSucker Pro, RAR Extractor Max, Mp3tag, Mole, HextEdit, Folder Preview Pro, Disk Doctor Pro, ServerCat and Bartender.

Researchers found both DMG and PKG versions, all lacking a valid signature and notarization. In the disk-image route, attackers changed the app configuration so a hidden executable named .macos runs when the user double-clicks the bundle.

It removes the quarantine attribute from the real app, opens that app as a decoy, then contacts a staging server. This tactic echoes malicious Git hook attacks that used job-related coding work to trigger malware.

The package route uses a different wrapper but reaches the same destination. The unsigned installer places a preinstall script under Application Support, while a postinstall script launches it.

That script fetches the next stage and attempts to clear the protection flag from the installed application. The hidden executable is built for Intel processors, so Apple-silicon Macs need Rosetta 2 before it can launch.

The dependency is notable because researchers have previously documented x86-64 macOS malware delivery designed around Rosetta 2, but it does not remove the need for victim interaction in this case.

Job Lures Expand Attack Chain

The first downloaded script creates a concealed ~/.task folder and retrieves tokenlinux.sh. The next script downloads Node.js, a malicious parser.js file and supporting components, runs an installation command, and launches the final program.

Later retrieval requests carry short-lived signed tokens that appear designed to track the session and control access to each stage.

OtterCookie contains a Socket.IO-based remote-access component, a browser and wallet credential stealer, an in-memory file scanner and a clipboard collector.

Its use is consistent with OtterCookie hidden in SVGs, another campaign that targeted developers through a seemingly legitimate project.

The samples may reflect active testing or early development because they do not run by default. Still, the combined social engineering and staged delivery show why a security warning should not be treated as a routine obstacle.

Users should obtain Mac software only from trusted sources, verify a developer signature where possible, and avoid removing the quarantine attribute merely to make an unfamiliar app run.

Organizations should keep threat prevention, advanced detection and web controls enabled to block and report similar activity, particularly for staff handling interview assignments or external code.

The campaign also reinforces the need to review repositories, package scripts and unexpected installers before execution.

Earlier fake interview malware campaigns show that the same recruitment pretext can be adapted across platforms, while this variant demonstrates that familiar Mac app names remain effective bait.

Indicatprs of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.