New macOS malware chain could cause a major security headache - here's what we know

• Jamf reports North Korean actors using fake job ads and ClickFix tactics to target macOS users
• Victims are tricked into running curl commands in Terminal, installing FlexibleFerret backdoor malware
• The campaign, dubbed Contagious Interview, enables credential theft, file exfiltration, and system compromise

North Korean state-sponsored threat actors are targeting macOS users with new malware, utilizing a strategy that combines two popular approaches - fake job ads, and ClickFix, experts have warned.

Security researchers Jamf confirmed they have spotted attacks in the wild using ClickFix, an attack method in which the victim is presented with a fake problem, and at the same time, presented with a fix. It is an evolution of the old “You have a virus” popup that dominated the internet in the early 2000’s.

Jamf says ‘DPRK-aligned operators’ from the FlexibleFerret malware family have been creating fake companies, fake LinkedIn profiles and, most importantly - fake ...