{"id":3282,"date":"2025-02-04T15:02:01","date_gmt":"2025-02-04T15:02:01","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/north-korean-hackers-use-fake-job-interviews-to-spread-macos-ferret-malware\/"},"modified":"2025-02-04T15:02:02","modified_gmt":"2025-02-04T15:02:02","slug":"north-korean-hackers-use-fake-job-interviews-to-spread-macos-ferret-malware","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/north-korean-hackers-use-fake-job-interviews-to-spread-macos-ferret-malware\/","title":{"rendered":"North Korean Hackers Use Fake Job Interviews to Spread macOS FERRET Malware"},"content":{"rendered":"\n<\/p>\n

North Korean Threat Actors Use Fake Job Interviews to Spread macOS Malware<\/strong><\/p>\n

February 4, 2025<\/strong><\/p>\n

By Ravie Lakshmanan<\/p>\n

Malware \/ Cryptocurrency<\/strong><\/p>\n

<\/a><\/div>\n

North Korean threat actors behind the Contagious Interview campaign have been observed delivering a collection of Apple macOS malware strains dubbed FERRET as part of a supposed job interview process. The campaign targets developers, who are asked to communicate with the threat actors through email.<\/p>\n

Impersonating Legitimate Software<\/strong><\/p>\n

By impersonating the legitimate postcss library, which has over 16 billion downloads, the threat actor aims to infect developers’ systems with credential-stealing and data-exfiltration capabilities across Windows, macOS, and Linux systems. Security researchers Kirill Boychenko and Peter van der Zee said, "The threat actor aims to infect developers’ systems with credential-stealing and data-exfiltration capabilities across Windows, macOS, and Linux systems."<\/p>\n

Connection to APT37 Threat Actor<\/strong><\/p>\n

The development also follows the discovery of a new campaign mounted by the North Korea-aligned APT37 (aka ScarCruft) threat actor that involved distributing booby-trapped documents via spear-phishing campaigns to deploy the RokRAT malware, as well as propagate them to other targets over group chats through the K Messenger platform from the compromised user’s computer.<\/p>\n

Read More<\/strong><\/p>\n

If you found this article interesting, follow us on Twitter \uf099<\/i> and LinkedIn to read more exclusive content we post.<\/p>\n