Threat actors with ties to North Korea are running a macOS malvertising campaign that steers users from sponsored search results to fake full-screen update pages and delivers malware capable of emptying cryptocurrency wallets and harvesting cloud and SSH credentials. Security firm AllSecure attributes the operation to a new iteration of the long-running Contagious Interview campaign, also tracked as UNC5342.
Contagious Interview Expands From Fake Developer Jobs to Search-Ad Lures
The entry lure in this iteration departs from the campaign’s signature fake job interview pattern. In the observed case, the victim searched for electrophoresis machines and clicked a sponsored result for a company that appeared to sell them, which led to a full-screen macOS update and reboot prompt. AllSecure co-founder and CEO Christian Papathanasiou said the same operational logic is now appearing in a broader browsing scenario, and that it does not replace the fake-job pattern so much as expand the threat model.
The shift matters because Contagious Interview previously depended on targeting software developers through fabricated job opportunities. A malvertising ladder that begins with an ordinary product search exposes everyday macOS users, not just engineers seeking employment, to the same payload family.
How the ClickFix Update Screen Delivers a Node.js Backdoor
The bogus update screen uses the ClickFix technique: it stealthily copies a curl command to the clipboard and prompts the victim to paste it into Terminal, which executes the next stage. AllSecure described the experience as designed to induce panic, and the fake activation is single-use, meaning attempts to reproduce the sequence do not yield the same result.
The curl command fetches a Node.js backdoor that establishes persistence through a LaunchAgent, checks in with its command-and-control server every five minutes, and executes any JavaScript the server returns. That arrangement gives the operator arbitrary remote execution on an infected Mac with little interaction beyond the initial paste.
EtherHiding: Blockchain-Hosted Command and Control From Two Throwaway Wallets
The malware extracts its live C2 address from an Ethereum smart contract, a takedown-resistant approach known as EtherHiding that North Korean actors have used in prior campaigns. Two Ethereum addresses embedded in the malware act as configuration for the command servers “rg-telemetry[.]sbs/api” and “th-updates[.]sbs/analytics”.
AllSecure found that both contracts were created by throwaway wallets running an identical four-step script: fund roughly 0.0126 ETH, deploy the contract, write the configuration, forward roughly 0.006 ETH, and abandon the wallet. The repeated workflow suggests industrialized deployment rather than bespoke infrastructure per victim, and it makes the C2 layer difficult to dismantle because the address lives on a public ledger the operators do not control.
Two Payloads: A 157-Wallet Stealer and a Sideloaded Chrome Drainer
The campaign delivers two payloads from the same wallet cluster, which AllSecure said indicates a single actor. The first is an information stealer that harvests data from web browsers and 157 cryptocurrency wallets, along with SSH, AWS, Azure, and npm keys. The second is a malicious “Google Drive Offline” Chrome extension that is sideloaded by patching Chrome’s Secure Preferences file and is designed to drain victims’ wallets.
The dual-payload design means an infected user can lose both long-term access credentials for cloud infrastructure and immediate balances in a large set of cryptocurrency wallets. Because the drainer lives inside the browser rather than as a standalone process, it can persist across normal anti-malware scanning of the operating system.
Why the Single-Use Activation Complicates Detection
The single-use fake update page makes the infection sequence difficult to reproduce, which limits how many organizations can independently reconstruct the full attack chain from a captured sample. AllSecure’s findings rest on the one observed case, and the report notes the operational logic has broadened into everyday browsing, implying the technique may be adapted further across different lures.
The campaign’s progression from a developer-focused fake-job operation to a malvertising ladder aimed at general web searches points to a deliberate expansion of reach. In that respect it mirrors how other North Korean cryptocurrency-theft operations have widened their targeting over recent years as earlier lures grew stale.
Defensive Guidance for macOS Users Facing Full-Screen Update Prompts
No CVE or vendor patch applies to the campaign. AllSecure advises treating full-screen update and reboot prompts, as well as any instruction to paste a command into Terminal, with suspicion; avoiding sponsored search results; and verifying software-update prompts through official channels before acting.
For organizations, macOS endpoints are now in scope for a North Korean wallet-theft operation previously associated with Windows tooling and developer lures. Users holding cryptocurrency wallets or managing cloud infrastructure from a Mac are the primary exposure group, and the campaign reinforces the case for treating browser extensions and clipboard-driven installation as untrusted vectors even on fully patched systems.
