North Korean EtherHiding Campaign Targets Crypto Wallets and Developer Credentials

A North Korean-linked cyber campaign is using fake macOS update screens to trick victims into installing malware. The operation targets cryptocurrency wallets, browser data, and developer credentials, turning a routine web search into a possible entry point for a serious compromise. The attack begins with a ClickFix-style lure that makes a browser page look like a frozen or rebooting Mac. Victims are told to open Terminal and paste a command that the malicious page has already copied to their clipboard, allowing the infection chain to start. AllSecure analysts identified the activity while investigating a malvertising incident tied to ordinary online research. The researchers linked the campaign’s methods to North...

Read the full article at the source.