Misty 23pds Alert: Lazarus Group releases a new macOS toolkit targeting cryptocurrencies

Mandiant’s Chief Information Security Officer 23pds issued an alert on April 22, stating that the North Korean hacking group Lazarus Group has released a new native macOS malware toolkit called “Mach-O Man,” which is specifically designed to target the cryptocurrency industry and executives at high-value enterprises.

Attack Methods and Targets

According to Mauro Eldritch’s analysis report, this campaign uses the ClickFix technique: the attackers send a link disguised as a legitimate meeting invitation via Telegram (using a contact account that has been compromised). The link leads the target to a fake website impersonating Zoom, Microsoft Teams, or Google Meet, and prompts users to run a command in the macOS terminal to “fix” the connection problem. This operation enables the attackers to gain system access without triggering traditional security control measures.

The attack targets include: credentials and cookies stored by browsers, data from the macOS Keychain, and extension data from browsers such as Brave, Vivaldi, Opera, Chrome, Firefox, and Safari. The stolen data is leaked through the Telegram Bot API; the report indicates that the attackers exposed a Telegram bot token (an OPSEC mistake), weakening their operational security.

The primary targets are developers, executives, and decision-makers in fintech and the cryptocurrency industry, as well as high-value enterprise environments where macOS is widely used.

Main Components of the Mach-O Man Toolkit

Based on Mauro Eldritch’s technical analysis, the toolkit consists of the following main modules:

teamsSDK.bin: Initial dropper, disguised as Teams, Zoom, Google, or system applications, performing basic system fingerprint identification

D1{random string}.bin: System analyzer, collecting the hostname, CPU type, operating system information, and browser extension lists, then sending them to the C2 server

minst2.bin: Persistence module, creating a disguised “Antivirus Service” directory and LaunchAgent to ensure continuous execution after each login

macrasv2: Final stealer, collecting browser credentials, cookies, and macOS Keychain entries, packaging them, leaking them via Telegram, and then self-deleting

Key Intrusion Indicators (IOCs) Summary

According to the IOCs published in Mauro Eldritch’s report:

Malicious IPs: 172[.]86[.]113[.]102 / 144[.]172[.]114[.]220

Malicious domains: update-teams[.]live / livemicrosft[.]com

Key files (partial): teamsSDK.bin, macrasv2, minst2.bin, localencode, D1YrHRTg.bin, D1yCPUyk.bin

C2 communication ports: 8888 and 9999; primarily uses a Go HTTP client User-Agent characteristic string

For the complete hashes and the ATT&CK matrix, see Mauro Eldritch’s original research report.

Frequently Asked Questions

“Mach-O Man” toolkit: Which industries and targets does it focus on?

According to Mandiant’s 23pds alert and BCA LTD’s research, “Mach-O Man” mainly targets the fintech and cryptocurrency industry, as well as high-value enterprise environments where macOS is widely used—especially the developer, executive, and decision-maker groups.

How do attackers trick macOS users into running malicious commands?

According to Mauro Eldritch’s analysis, the attackers send links via Telegram disguised as legitimate meeting invitations, leading users to fake websites impersonating Zoom, Teams, or Google Meet. They then prompt users to run commands in the macOS terminal to “fix” connection issues, thereby triggering the installation of the malware.

How does “Mach-O Man” achieve data exfiltration?

According to Mauro Eldritch’s technical analysis, the final module macrasv2 collects browser credentials, cookies, and macOS Keychain data, packages them, and exfiltrates them via the Telegram Bot API. Meanwhile, the attackers use a self-deleting script to clear system traces.