The North Korean Lazarus Group launches a macOS malware attack targeting crypto and fintech executives.

According to CoinDesk, the North Korean hacking group Lazarus Group is launching a new macOS attack campaign called “Mach-O Man,” targeting executives and institutions in high-value sectors such as cryptocurrency and fintech. The attack employs a social engineering technique called “ClickFix,” tricking victims into pasting commands into their Mac terminals to gain access to enterprise systems, SaaS platforms, and financial resources. CertiK researchers state that “Mach-O Man” is a modular macOS malware toolkit developed by Lazarus Group, now being used by other cybercriminal groups, and often self-deletes before victims notice, increasing the difficulty of attribution and detection. Additionally, attackers have already carried out this campaign by hijacking DeFi project domains and replacing them with fake Cloudflare messages.