Elastic Security Labs has uncovered a sophisticated cyber intrusion by North Korean hackers believed to be associated with the Lazarus group. This incident, tracked as REF7001, involved the use of a new macOS malware named Kandykorn, which has been specifically designed to target blockchain engineers involved in cryptocurrency exchange platforms. What sets this attack apart is its distribution method: the attackers distributed the malware through a private message on a public Discord server, which is atypical of macOS intrusion tactics. “The victim believed they were installing an arbitrage bot, a software tool capable of profiting from cryptocurrency rate differences,” said Elastic Security Labs.
Source: Wayne Jones, 2023-11-05; https://cryptopotato.com/macos-users-beware-north-korean-hackers-on-the-prowl/