North Korea's Lazarus Group has deployed a modular macOS malware toolkit named Mach-O Man that uses fake meeting invitations to steal credentials and cryptocurrency wallet access from fintech executives and developers. The discovery was made by Bitso's Quetzal Team in collaboration with ANY.RUN sandbox platform, with their analysis released publicly on April 21, 2026.
Four-Stage Attack Chain: From Social Engineering to Data Exfiltration
Mach-O Man is written in Go and compiled as Mach-O binaries native to both Intel and Apple Silicon machines. The attack chain consists of four stages: initial stager, profiling, persistence, and credential theft. Infection begins with social engineering, not a software exploit. Attackers compromise or impersonate Telegram accounts of colleagues in Web3 and crypto circles, sending an urgent meeting invite for Zoom, Microsoft Teams, or Google Meet that links to a convincing fake site such as update-teams.live or livemicrosft.com.
The fake site displays a simulated connection error and instructs the target to copy-paste a Terminal command to resolve it. This Clickfix technique, adapted for macOS, leads the user to execute the initial stager file (teamsSDK.bin) via curl. Because the user runs the command manually, macOS Gatekeeper does not block it. The stager downloads a fake app bundle, applies ad-hoc code signing to appear legitimate, and prompts for the macOS password. The window shakes on the first two attempts and accepts the credential on the third — a deliberate design to build false trust.
During profiling, a binary enumerates hostname, UUID, CPU, OS details, running processes, and browser extensions across Brave, Chrome, Firefox, Safari, Opera, and Vivaldi. Researchers noted a coding bug in the profiler that creates an infinite loop, causing noticeable CPU spikes that can expose an active infection. The persistence module then drops a renamed file called Onedrive into a hidden path under a folder labeled "Antivirus Service" and registers a LaunchAgent (com.onedrive.launcher.plist) for automatic startup at login.
The final stealer binary (macrasv2) collects browser extension data, SQLite credential databases, and Keychain items, compresses them into a zip, and exfiltrates via the Telegram Bot API. Researchers found the Telegram bot token embedded in the binary — a major operational security failure that could allow defenders to monitor or disrupt the channel.
Link to Past Attacks and Mitigation Advice
The Quetzal Team linked the toolkit to Lazarus's recent large-scale cryptocurrency thefts, including attacks on KelpDAO and Drift. Prior Lazarus macOS tools included Applejeus and Rustbucket; Mach-O Man follows the same target profile while lowering the technical barrier for macOS compromises. Security researchers also observed the kit being used by groups beyond Lazarus, suggesting the tooling has been shared or sold within the threat actor ecosystem.
The team published SHA-256 hashes for all major components and network indicators pointing to IPs 172.86.113.102 and 144.172.114.220. Defenders are advised to audit LaunchAgent directories, monitor for Onedrive processes from unusual paths, and block outbound Telegram Bot API traffic where not operationally required. Users should never paste Terminal commands from web pages or unsolicited meeting links. In Apple-heavy crypto environments, any urgent, unsolicited meeting link should be treated as a potential entry point until verified through a separate channel.