The infamous Lazarus group makes headlines again as the North Korean cybercrime syndicate appeared to mimic job offers from ‘Crypto.com’ to steal cryptocurrency and NFTs from unsuspecting users.
Back in August 2022, Lazarus impersonated Coinbase and marketed malicious job offers to IT workers to spread Windows and macOS malware.
RELATED RESOURCE
Cyber resiliency and end-user performance
Reduce risk and deliver greater business success with cyber-resilience capabilities
The cybercrime group is now masquerading job offers from Crypto.com. The ongoing phishing campaign, by far, targets macOS users. Per reports, the malware is identical to that found in fake Coinbase job postings.
Akin to previous macOS campaigns, the Lazarus group approached its targets via LinkedIn to send a macOS binary masked as a PDF containing a 26-page PDF file named 'Crypto.com_Job_Opportunities_2022_confidential.pdf' comprising counterfeit job vacancies at Crypto.com.
“Consistent with observations in the earlier campaign, this PDF is created with MS Word 2016, PDF version 1.5. The document author is listed as ‘UChan’,” confirmed Sentinel One in a report.
“The first stage malware opens the PDF decoy document and wipes the Terminal’s current savedState.”
“The second stage in the Crypto.com variant is a bare-bones application bundle named ‘WifiAnalyticsServ.app’; this mirrors the same architecture seen in the Coinbase variant, which used a second stage called ‘FinderFontsUpdater.app’,” explained Sentinel One.
However, despite the scope of the attack, Sentinel revealed Lazarus’ campaign is supposedly short-termed as the binaries are devoid of any encryption.
-
Netgear launches next-gen platform and says it's quality vs quantity re partner engagementNews This is a significant launch, according to the company, and one that aligns with its overarching goal to simplify complexity...
-
What users can expect with Claude Sonnet 5News Claude Sonnet 5 comes with intuitive agentic capabilities, performance boosts, and cost-efficient ‘effort levels’
