Ravie LakshmananJul 30, 2026Malvertising / Cryptocurrency
Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign.
The defining aspect of the attack is that bogus macOS software update screen stealthily copies an attack command to the clipboard and then prompts the victim to execute it via the Terminal app, a known technique referred to as ClickFix.
"The experience is designed to induce panic," AllSecure said in a report shared with The Hacker News. "The computer appears frozen or rebooting, so a user who believes the OS has failed follows instructions they would otherwise find suspicious."
The campaign is also noteworthy for its use of blockchain-hosted command-and-control (C2), with the malware extracting the live server address from an Ethereum smart contract. This takedown-resistant approach, referred to as EtherHiding, has been put to use by North Korean threat actors in prior campaigns associated with Contagious Interview (aka UNC5342).
