Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access

Security analyst reveals how Lazarus Group uses a macOS malware kit “Mach-O Man,” luring victims via fake Zoom and Google Meet links to execute malicious commands and gain full system access

𝕏/@officer_secret •

Revision history

8 recorded changes

Want your article here?

Promote with Leviathan News

More on malware

MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraud

MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraud

𝕏/@MetaMask ·

Hackers hide malware in GitHub, npm, and VS Code packages using invisible Unicode so supply‑chain attacks bypass human review and common defenses.

Hackers hide malware in GitHub, npm, and VS Code packages using invisible Unicode so supply‑chain attacks bypass human review and common defenses.

Arstechnica ·

Malicious npm package disguised as OpenClaw AI installer deploys full RAT stealing crypto wallets, macOS Keychain, and cloud credentials

Malicious npm package disguised as OpenClaw AI installer deploys full RAT stealing crypto wallets, macOS Keychain, and cloud credentials

The Hacker News ·

Fake Claude Code install guides lure developers into running Amatera infostealer via malvertised Google Ads

Fake Claude Code install guides lure developers into running Amatera infostealer via malvertised Google Ads

Pushsecurity ·

⚠️ New two‑stage Windows malware campaign “LeakyInjector”/“LeakyStealer,” signed with a valid EV certificate, stealthily injects into explorer.exe to steal data from popular crypto wallets and exfiltrate it to a remote C2.

⚠️ New two‑stage Windows malware campaign “LeakyInjector”/“LeakyStealer,” signed with a valid EV certificate, stealthily injects into explorer.exe to steal data from popular crypto wallets and exfiltrate it to a remote C2.

𝕏/@AckeeBlockchain ·

Akshit (Epoch Protocol) lost over $20k after running a malicious repo linked to the “contagious interview” malware, allegedly tied to DPRK hackers. The code granted root access, leaked env keys, and drained multiple EVM and Solana wallets—highlighting how dev hygiene lapses can be fatal.

Akshit (Epoch Protocol) lost over $20k after running a malicious repo linked to the “contagious interview” malware, allegedly tied to DPRK hackers. The code granted root access, leaked env keys, and drained multiple EVM and Solana wallets—highlighting how dev hygiene lapses can be fatal.

𝕏/@OstwalAk ·

MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraud

MetaMask flags rise of AI-driven crypto attacks, from fake Google security pages to malware hitting 850+ extensions, exposing growing risks in automated fraud

𝕏/@MetaMask ·

Hackers hide malware in GitHub, npm, and VS Code packages using invisible Unicode so supply‑chain attacks bypass human review and common defenses.

Hackers hide malware in GitHub, npm, and VS Code packages using invisible Unicode so supply‑chain attacks bypass human review and common defenses.

Arstechnica ·

Malicious npm package disguised as OpenClaw AI installer deploys full RAT stealing crypto wallets, macOS Keychain, and cloud credentials

Malicious npm package disguised as OpenClaw AI installer deploys full RAT stealing crypto wallets, macOS Keychain, and cloud credentials

The Hacker News ·

Fake Claude Code install guides lure developers into running Amatera infostealer via malvertised Google Ads

Fake Claude Code install guides lure developers into running Amatera infostealer via malvertised Google Ads

Pushsecurity ·

⚠️ New two‑stage Windows malware campaign “LeakyInjector”/“LeakyStealer,” signed with a valid EV certificate, stealthily injects into explorer.exe to steal data from popular crypto wallets and exfiltrate it to a remote C2.

⚠️ New two‑stage Windows malware campaign “LeakyInjector”/“LeakyStealer,” signed with a valid EV certificate, stealthily injects into explorer.exe to steal data from popular crypto wallets and exfiltrate it to a remote C2.

𝕏/@AckeeBlockchain ·

Akshit (Epoch Protocol) lost over $20k after running a malicious repo linked to the “contagious interview” malware, allegedly tied to DPRK hackers. The code granted root access, leaked env keys, and drained multiple EVM and Solana wallets—highlighting how dev hygiene lapses can be fatal.

Akshit (Epoch Protocol) lost over $20k after running a malicious repo linked to the “contagious interview” malware, allegedly tied to DPRK hackers. The code granted root access, leaked env keys, and drained multiple EVM and Solana wallets—highlighting how dev hygiene lapses can be fatal.

𝕏/@OstwalAk ·

Explore the full feed

Up nextAnthropic yanks Claude Code from Pro plan without warning, forcing 5x pricing jump to $100/month Max tier