MacOS computer users are being targeted by the Lazarus hacker collective with fileless malware that’s designed to resemble a cryptocurrency trading app.

Best known as the group linked to major cyberattacks such as WannaCry and the hack on Sony Pictures Entertainment, the latest campaign from Lazarus involves trojanizing an open-source Apple software application to steal cryptocurrency, according to a report from K7 Labs.

The infection process starts by writing files to a disk, after which its final executable loads directly onto memory. This classifies the threat as fileless malware, researchers explained.

The AppleJeus Attack Close Up

Known as OSX.AppleJeus.C, the malware connects to a remote server to receive a payload from Lazarus while continuing to run out of the infected machine’s main memory.

A trojanized version of UnionCryptoTrader.dmg, another cryptocurrency trading container, was also discovered as part of the investigation. Researchers said the campaign may have been running since this past June.

Fortunately, raising awareness about the threat may limit its impact, given the steps attackers need to take to infect a machine. These include getting a potential victim to click through a pop-up that alerts them to an unsigned installer, and a second prompt that requires them to agree to giving root access to the installer.

This is not the first time Lazarus has attempted this kind of attack. Two months ago, Objective See reported on a backdoor Trojan based on a cryptocurrency application that was made available through the code-sharing repository Github. Kaspersky Lab also detected early variants of the AppleJeus malware back in 2018.

How to Lock Out the Likes of Lazarus for Good

Fileless malware has often been associated with Windows machines, given the amount of existing code on PCs, but the Lazarus attack shows macOS users are by no means immune.

Besides making sure patches are up to date and providing solid security training to employees and other end users, organizations should also consider adopting tools to monitor for and warn about advanced persistent threats that may be aimed at their networks.