Caught in a Job Scam: North Korean Hackers Spread FERRET Malware on macOS
North Korean hackers are behind the Contagious Interview campaign, which targets victims with fake job interviews. The hackers send a link that causes an error, prompting users to install fake software (like VCam or CameraAccess) for the interview. This leads to the installation of malware called BeaverTail, which steals sensitive data and can install a backdoor named InvisibleFerret.
Discovered in late 2023, the campaign uses fake video-conferencing apps and npm packages to spread malware. In late 2024, new tactics emerged, including tricking macOS users into running harmful commands via the Terminal app to fix camera or microphone issues. The malware can also persist on the system through a LaunchAgent.
The hackers have expanded their targets to include developers by posting fake issues on GitHub and distributing malicious npm packages like postcss-optimizer. They’ve also been linked to phishing attacks spreading the RokRAT malware via malicious documents.
Mitigation Tips:
- Avoid Unknown Links: Be cautious with job offers or interview invitations from unknown sources. Verify the sender before clicking.
- Install Trusted Software: Only update or install software from official sources.
- Use Anti-Malware Software: Keep your antivirus up to date to detect and block threats.
- Verify Developer Tools: Developers should ensure packages and libraries are legitimate before downloading.
- Enable Two-Factor Authentication (2FA): Protect your online accounts, especially crypto wallets, with 2FA.
Source: https://thehackernews.com/2025/02/north-korean-hackers-deploy-ferret.html