Threat actors with ties to North Korea have been linked to a sophisticated macOS malvertising campaign. This operation involves redirecting users to fake web pages displaying a full-screen, non-existent update sequence designed to deliver malware. This marks a new iteration of the long-running **Contagious Interview** campaign. The defining aspect of the attack is that the bogus macOS software update screen stealthily copies an attack command to the clipboard. It then prompts the victim to execute it via the Terminal app, a known technique referred to as **ClickFix**. "The experience is designed to induce panic," **AllSecure** stated in a report shared with The Hacker News. "The computer appears frozen or rebooting, so a user who believes the OS has failed follows instructions they would otherwise find suspicious." The campaign is also noteworthy for its use of blockchain-hosted command-and-control (C2). The malware extracts the live server address from an **Ethereum** smart contract. This takedown-resistant approach, referred to as **EtherHiding**, has been employed by North Korean threat actors in prior campaigns associated with **Contagious Interview** (also known as **UNC5342**). The end goal of the attacks is to facilitate remote code execution. This allows the implant to poll the C2 server and fetch two additional payloads: an information stealer capable of targeting 157 cryptocurrency wallets and a malicious **Chrome** extension. ### The Deceptive Attack Chain The attack chain departs from typical **Contagious Interview** campaigns in that the starting point involves clicking on a search result for an unspecified target company. As soon as the website opens, the browser displays the full-screen macOS reboot message, giving the impression that a software update is underway, while stealthily setting the stage for the next phase of the infection. Once the fake update sequence completes, the bogus page prompts the user to open the Terminal app and paste an already copied command into the system's clipboard. Interestingly, any attempts to reproduce this sequence do not yield the same result, indicating the activation is intended to be single-use.  What's interesting here is that the initial lure was not a suspicious job offer, a video assessment, or a coding test, all of which have been various methods the **Contagious Interview** cluster has employed in the past. Instead, it begins with a seemingly harmless web search. In the case observed by **AllSecure**, the victim was reportedly searching for electrophoresis machines and clicked on a sponsored result for a company that appeared to sell them. The infection sequence began immediately after the fake page loaded in their browser. ### Malicious Payloads and Persistence The command pasted into Terminal is a `curl` command designed to fetch the next-stage malware. This leads to the execution of a **Node.js** backdoor that uses a **LaunchAgent** for persistence and calls an **Ethereum** contract to resolve the C2 server address. The implant is configured to check in with the server every five minutes and execute any **JavaScript** code returned by it. The **EtherHiding** mechanism serves as a conduit for two primary payloads: * An information stealer that harvests data from web browsers (**Chrome**, **Brave**, **Edge**, **Firefox**, **Opera**, and **Vivaldi**), 157 cryptocurrency wallets, as well as **SSH**, **AWS**, **Azure**, and **npm** keys. * A malicious "Google Drive Offline" extension that is sideloaded into the browser by patching **Chrome's Secure Preferences** file and is used to drain a victim's wallet. Two **Ethereum** addresses are embedded into the malware, both acting as **EtherHiding** configurations responsible for fetching the actual C2 servers: "rg-telemetry[.]sbs/api" and "th-updates[.]sbs/analytics." "Each contract was created by a throwaway wallet running an identical four-step script: funded with ~0.0126 ETH, deploy the contract, write the config, forward the leftover ~0.006 ETH onward, then abandon the wallet," **AllSecure** said. "The pattern suggests an operator that has industrialised deployment: fund, deploy, configure, drain leftovers, abandon, repeat." Further analysis has determined that both the backdoor and the browser-extension drainer are funded from the same wallet cluster, indicating that the activity is the work of a single actor. "The delivery context is also worth noting: DPRK-linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario," **Christian Papathanasiou**, co-founder and CEO of **AllSecure**, explained. "That does not replace the fake-job pattern; it expands the threat model."