14 Fake macOS Installers Linked to DPRK Campaign Deliver Credential-Stealing RAT

Mac users are being targeted with 14 fake application installers that appear to offer familiar software but instead start a credential-stealing remote-access trojan.

The files were distributed as macOS disk images and installer packages, giving attackers another route into systems used by developers and job seekers.

The activity is tied to the long-running Contagious Interview campaign, in which attackers pose as recruiters and send coding tests, repositories or packages to prospective candidates.

This latest wave moves the lure outside the usual developer workflow and hides the infection inside software installers.

Jamf Threat Labs identified the installer cluster and linked its staging infrastructure to earlier Git-hook and Visual Studio Code task-file attacks.

The final payload is OtterCookie, a remote-access trojan that can take browser and cryptocurrency-wallet credentials, search for sensitive files and monitor clipboard data.

Jamf said in a report shared with Cyber Security News (CSN) that it gives operators a path to valuable account data and a channel for commands on the affected Mac.

Security teams should treat reports of unsolicited interview software as possible security incidents, especially when applicants are asked to disable safeguards, run terminal commands, or install a package outside normal distribution channels.

14 Fake macOS Installers Linked to DPRK Campaign

The 14 samples impersonate applications including The Unarchiver, Presentify, PDFify, Magic Disk Cleaner, Sketch, SiteSucker Pro, RAR Extractor Max, Mp3tag, Mole, HextEdit, Folder Preview Pro, Disk Doctor Pro, ServerCat and Bartender.

Researchers found both DMG and PKG versions, all lacking a valid signature and notarization. In the disk-image route, attackers changed the app configuration so a hidden executable named .macos runs when the user double-clicks the bundle.

It removes the quarantine attribute from the real app, opens that app as a decoy, then contacts a staging server. This tactic echoes malicious Git hook attacks that used job-related coding work to trigger malware.

The package route uses a different wrapper but reaches the same destination. The unsigned installer places a preinstall script under Application Support, while a postinstall script launches it.

That script fetches the next stage and attempts to clear the protection flag from the installed application. The hidden executable is built for Intel processors, so Apple-silicon Macs need Rosetta 2 before it can launch.

The dependency is notable because researchers have previously documented x86-64 macOS malware delivery designed around Rosetta 2, but it does not remove the need for victim interaction in this case.

Job Lures Expand Attack Chain

The first downloaded script creates a concealed ~/.task folder and retrieves tokenlinux.sh. The next script downloads Node.js, a malicious parser.js file and supporting components, runs an installation command, and launches the final program.

Later retrieval requests carry short-lived signed tokens that appear designed to track the session and control access to each stage.

OtterCookie contains a Socket.IO-based remote-access component, a browser and wallet credential stealer, an in-memory file scanner and a clipboard collector.

Its use is consistent with OtterCookie hidden in SVGs, another campaign that targeted developers through a seemingly legitimate project.

The samples may reflect active testing or early development because they do not run by default. Still, the combined social engineering and staged delivery show why a security warning should not be treated as a routine obstacle.

Earlier fake interview malware campaigns show that the same recruitment pretext can be adapted across platforms, while this variant demonstrates that familiar Mac app names remain effective bait.

Indicatprs of compromise (IoCs):-