Fake macOS Installers Distribute Credential‑Stealing RAT in North Korea‑Linked Campaign

Security researchers have uncovered a new wave of malicious macOS installers that masquerade as popular applications, only to deploy a credential‑stealing remote‑access trojan. Fourteen distinct disk images and installer packages were identified, each crafted to look like legitimate software while silently compromising the victim's system.

The malicious bundles were distributed through various online channels, including file‑sharing sites and forums where users commonly exchange macOS utilities. Once a user runs the installer, the payload installs a backdoor that harvests saved passwords, authentication tokens, and other sensitive data, then transmits the information to command‑and‑control servers controlled by actors linked to the Democratic People’s Republic of Korea.

Analysis of the code revealed a consistent set of indicators: the same obfuscation techniques, shared encryption keys, and a common network‑communication routine that contacts servers hosted in jurisdictions often used by North Korean cyber units. These technical fingerprints align with previous campaigns attributed to the DPRK’s Lazarus Group, which has a history of targeting both Windows and macOS environments for espionage and financial gain.

While macOS has traditionally been viewed as a less attractive target compared to Windows, the rise of cross‑platform malware demonstrates that attackers are expanding their reach. The new trojan not only captures credentials but also provides remote control capabilities, allowing operators to execute arbitrary commands, install additional software, or pivot to other devices on the same network.

Experts warn that the deceptive naming of the installers—often mimicking well‑known productivity tools or developer utilities—makes them especially dangerous for less‑technical users who may trust the appearance of the files. Users are advised to verify the source of any macOS installer, prefer official app stores, and enable Gatekeeper’s stricter verification settings to block unsigned software.

Cybersecurity firms are now issuing alerts and updating detection signatures to help endpoint protection products recognize the malicious disk images. As the campaign unfolds, analysts expect the operators to refine distribution methods, potentially leveraging social engineering or compromised websites to broaden their reach. Continuous monitoring and prompt patching remain critical defenses against this emerging macOS threat.