December 10, 2019 By Shane Schick 2 min read

MacOS computer users are being targeted by the Lazarus hacker collective with fileless malware that’s designed to resemble a cryptocurrency trading app.

Best known as the group linked to major cyberattacks such as WannaCry and the hack on Sony Pictures Entertainment, the latest campaign from Lazarus involves trojanizing an open-source Apple software application to steal cryptocurrency, according to a report from K7 Labs.

The infection process starts by writing files to a disk, after which its final executable loads directly onto memory. This classifies the threat as fileless malware, researchers explained.

The AppleJeus Attack Close Up

Known as OSX.AppleJeus.C, the malware connects to a remote server to receive a payload from Lazarus while continuing to run out of the infected machine’s main memory.

A trojanized version of UnionCryptoTrader.dmg, another cryptocurrency trading container, was also discovered as part of the investigation. Researchers said the campaign may have been running since this past June.

Fortunately, raising awareness about the threat may limit its impact, given the steps attackers need to take to infect a machine. These include getting a potential victim to click through a pop-up that alerts them to an unsigned installer, and a second prompt that requires them to agree to giving root access to the installer.

This is not the first time Lazarus has attempted this kind of attack. Two months ago, Objective See reported on a backdoor Trojan based on a cryptocurrency application that was made available through the code-sharing repository Github. Kaspersky Lab also detected early variants of the AppleJeus malware back in 2018.

How to Lock Out the Likes of Lazarus for Good

Fileless malware has often been associated with Windows machines, given the amount of existing code on PCs, but the Lazarus attack shows macOS users are by no means immune.

Besides making sure patches are up to date and providing solid security training to employees and other end users, organizations should also consider adopting tools to monitor for and warn about advanced persistent threats that may be aimed at their networks.

More from

What is the Open-Source Software Security Initiative (OS3I)?

3 min read - The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy.After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security of…

Widespread exploitation of recently disclosed Ivanti vulnerabilities

6 min read - IBM X-Force has assisted several organizations in responding to successful compromises involving the Ivanti appliance vulnerabilities disclosed in January 2024. Analysis of these incidents has identified several Ivanti file modifications that align with current public reporting. Additionally, IBM researchers have observed specific attack techniques involving the theft of authentication token data not readily noted in current public sources. The blog details the results of this research to assist organizations in protecting against these threats. Key Findings: IBM research teams have…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today