Mach-O Man Malware Steals macOS Keychain Data in Lazarus Group Crypto Campaign

"Mach-O Man is a modular macOS malware kit that uses social engineering tactics, such as fake meeting invites, to compromise high-value targets in the crypto and fintech sectors."

"The malware operates in four distinct stages, allowing attackers to harvest browser credentials, macOS Keychain entries, and access to crypto accounts before erasing its traces."

"Security researchers have urged firms to block Terminal-based ClickFix lures and to audit LaunchAgents for files masquerading as Onedrive to prevent infections."

Lazarus Group's Mach-O Man malware targets macOS users in the crypto and fintech sectors, utilizing fake meeting invites to steal credentials and crypto wallet access. The malware operates in four stages, enabling credential theft and data exfiltration. Security researchers from Bitso's Quetzal Team confirmed its deployment and urged firms to block specific lures and audit for malicious files. The kit is linked to previous large-scale crypto thefts and employs social engineering tactics to compromise targets through impersonated Telegram accounts.

Read at news.bitcoin.com