Lazarus Group Builds its First MacOS Malware

This isnt the first time Lazarus Group has infiltrated a cryptocurrency exchange as the hacking team has found new ways to achieve financial gain.

Same goals, new tools: Lazarus Group is targeting cryptocurrency exchanges with macOS malware, a sign the nation-state group is developing attacks for a broader variety of platforms to achieve its goal of financial gain.
This is the first case in which Kaspersky Lab researchers spotted Lazarus Group using malware targeting macOS. It seems the group - believed to be out of North Korea - wants to ensure OS platforms dont interfere with infecting targets, so its building malware for different operating systems. A version of the same malware tailored for Linux is reportedly in the works.
This should serve as a wake-up call for users of non-Windows platforms, researchers note.
Kaspersky Lab discovered the so-called Operation AppleJeus while investigating a cryptocurrency exchange attacked by Lazarus Group. Its target had been hit with a Trojanized cryptocurrency application recommended to the company via email. One employee opened the message and downloaded the third-party app, infecting their machine with an old Lazarus Group tool dubbed Fallchill.
Multiple reports, including one from
US-CERT
, in the past year have pointed to the reappearance of Fallchill. The malware, a fully functional remote access Trojan, has been leveraged in attacks on the aerospace, finance, and telecommunications industries since 2016. Kaspersky researchers used the appearance of Fallchill in this scenario as a base for attribution to Lazarus Group.
In Operation AppleJeus, the malicious code was pushed in an update to Celas Trade Pro, a cryptocurrency trading app from Celas Limited. The vendor has a valid digital certificate for signing software and legitimate-looking registration records for its domain. However, researchers couldnt find a legitimate business located at the address noted on the certificate.
When you start looking at bits and pieces behind the application, even that starts looking more and more illegitimate, says Kurt Baumgartner, principal security researcher at Kaspersky Lab.
When someone downloads the app only macOS, a hidden autoupdater module is installed in the background to begin immediately after the app is installed and after each system reboot. In most applications, updater components are used to download new program versions.
In the case of AppleJeus
, the updater is used to collect information about the target machine and transmit the data back to the command-and-control server. If attackers decide its worth infecting, they send a software update to install Fallchill. The Trojan provides attackers with almost unlimited access to the victim machine, giving them leeway to steal valuable financial data or deploy additional tools to snatch information.
Mac Attack
Lazarus Group developed software to target both the Windows and macOS platforms, and the malware works exactly the same on both operating systems. The extension to macOS is a recent and very narrow trend, Baumgartner notes.
For the most part we see APT, we see mass exploitations, we see a lot of malware targeting Windows users, he explains. This is the first time weve seen Lazarus in particular targeting macOS and users.
Why the move to Mac? Baumgartner isnt sure, but he speculates there is a possibility that cryptocurrency traders, and people on the cryptocurrency exchanges, are more interested – and disproportionately interested – in using macOS.
Theres no answer as to why, but that is new for them and it is unusual, he points out. Other threat groups, particularly Russian- and Chinese-speaking groups, have previously targeted macOS. Its a new move for Lazarus Group, but this isnt a one-time attack. Theyre broadening the platforms they support, he adds. Theyre going to continue going after macOS.
Because the Fallchill backdoor and C2 infrastructure have only been associated with the Trojanized cryptocurrency trading app, researchers believe the sole motive is financial gain.
Spotting Slip-ups: Where Lazarus Makes Mistakes
Baumgartner points out how Lazarus Group has a habit of dropping breadcrumbs, which simplify the process of attributing campaigns to the organization. One of the most interesting findings here comes from an additional backdoor hidden in hardcoded headers to communicate with the C2 server.
The Accept-Language HTTP header string revealed a language code associated with North Korea, which researchers say is unusual for malware. It seems the attackers forgot to change something in their developer environment, says Baumgartner.
They make little mistakes every now and then that give us those insights into what is really behind this activity, he continues. In a
previous incident
, a malware operator was using multiple IPs connecting between France and Korea, but one short connection was made from an unusual IP range originating in North Korea.
They do drop breadcrumbs, and these are pretty good breadcrumbs.
Related Content:
New Mirai Variants Leverage Open Source Project
Turla Threat Group Uses Email PDF Attachments to Control Stealthy Backdoor
It Takes an Average 38 Days to Patch a Vulnerability
7 Serious IoT Vulnerabilities
Learn from the industrys most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for
more info
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Lazarus Group Builds its First MacOS Malware