North Korea's Contagious Interview Campaign Has a New Trick — A Fake macOS Update That Freezes Your Screen and Steals Your Crypto

North Korean threat actors have expanded one of their most persistent malware campaigns with a new and more deceptive delivery method — a full-screen fake macOS update screen designed to induce panic and trick victims into executing malicious commands through their own Terminal app. The latest iteration of the Contagious Interview campaign abandons the fake job interview lure that defined earlier operations and replaces it with something far more accessible: a poisoned search result that anyone could encounter on an ordinary browsing session.

Key points

• The campaign uses a full-screen fake macOS reboot screen to panic victims into pasting a malicious command into Terminal — a ClickFix technique
• Command-and-control infrastructure is hosted on Ethereum smart contracts using EtherHiding, making it resistant to takedown
• The infection delivers an infostealer targeting 157 cryptocurrency wallets and browsers including Chrome, Brave, Edge, Firefox, Opera and Vivaldi
• A fake "Google Drive Offline" Chrome extension is sideloaded to drain victims' wallets directly
• The attack begins with a sponsored search result — not a job offer — significantly broadening the potential victim pool
• The activation sequence is single-use, making it difficult for researchers to reproduce and analyse

How the Attack Unfolds

The infection begins with a web search. In the case documented by security firm AllSecure, a victim searching for electrophoresis machines clicked a sponsored search result for what appeared to be a legitimate supplier. The moment the page loaded, the browser displayed a full-screen macOS reboot message — giving the convincing impression that a software update was underway.

The experience is engineered to provoke panic. The screen makes the computer appear frozen or in the process of rebooting. A user who believes their operating system has failed becomes far more likely to follow instructions they would otherwise treat with suspicion.

"The experience is designed to induce panic," AllSecure wrote in its report. "The computer appears frozen or rebooting, so a user who believes the OS has failed follows instructions they would otherwise find suspicious."

Once the fake update sequence completes, the page prompts the victim to open Terminal and paste a command — one that has already been silently copied to their clipboard without their knowledge. The command is a curl instruction that fetches the next stage of the malware. The activation is single-use: attempts to reproduce the sequence do not yield the same result, deliberately complicating forensic analysis.

The Infrastructure Built to Survive Takedowns

What sets this campaign apart technically is its command-and-control architecture. Rather than using a conventional server that can be identified and shut down, the malware retrieves its live C2 address from an Ethereum smart contract — a technique known as EtherHiding that has been used in previous Contagious Interview operations.

Blockchain-hosted infrastructure cannot be taken down the way a conventional server can. The Ethereum network is decentralised and immutable — once a smart contract is deployed with a C2 address embedded, that information remains accessible to the malware indefinitely, regardless of what law enforcement or security researchers do to the surrounding infrastructure.

AllSecure's analysis revealed that both Ethereum addresses embedded in the malware were created using a repeatable four-step pattern: fund a throwaway wallet with approximately 0.0126 ETH, deploy the contract, write the configuration, forward leftover funds and abandon the wallet. "The pattern suggests an operator that has industrialised deployment: fund, deploy, configure, drain leftovers, abandon, repeat," AllSecure said.

Both the backdoor and the browser extension drainer were found to be funded from the same wallet cluster, indicating the entire operation is the work of a single coordinated actor.

What the Malware Takes

The curl command executed in Terminal delivers a Node.js backdoor that establishes persistence through a LaunchAgent and checks in with the C2 server every five minutes, executing any JavaScript code the server returns. Through the EtherHiding mechanism, two payloads are delivered.

The first is an information stealer that harvests data from six major browsers — Chrome, Brave, Edge, Firefox, Opera and Vivaldi — alongside credentials from 157 cryptocurrency wallets, SSH keys, AWS and Azure credentials and npm authentication tokens. The breadth of targeting across cloud infrastructure credentials alongside crypto wallets suggests the campaign is oriented toward both immediate financial theft and longer-term access to developer and enterprise environments.

The second payload is a malicious Chrome extension posing as "Google Drive Offline." It is sideloaded into the browser by patching Chrome's Secure Preferences file — a technique that bypasses standard extension installation controls — and is used to drain the victim's connected cryptocurrency wallet directly.

A Significant Expansion of the Threat Model

Previous Contagious Interview campaigns — attributed to the North Korean cluster tracked as UNC5342 — have consistently relied on fake job offers, video assessments and coding tests as their initial lure. Those approaches require the victim to be actively engaged in a job search and willing to participate in a multi-step recruitment process.

The shift to a poisoned search result eliminates that requirement entirely. Any user conducting an ordinary web search on any topic could encounter a sponsored result leading to this infection chain. The attack surface is no longer limited to developers or job seekers — it extends to anyone who uses a search engine.

"That does not replace the fake-job pattern; it expands the threat model," said Christian Papathanasiou, co-founder and CEO of AllSecure. "DPRK-linked campaigns are often described through the lens of fake job interviews and developer recruitment, but this case shows the same operational logic appearing in a broader browsing scenario."

What macOS Users Should Know

macOS does not present update prompts through a web browser. Any full-screen message appearing in a browser window claiming the operating system needs to update, has crashed or requires Terminal commands to resolve is not a legitimate system message — it is a social engineering attack.

Legitimate macOS software updates appear exclusively through System Settings or the App Store. No genuine update process will ever instruct a user to open Terminal and paste a command. Any prompt making that request, regardless of how convincing the surrounding interface appears, should be dismissed immediately and the page closed.

Users who believe they may have executed a command through this type of prompt should treat their device as potentially compromised, audit recently installed browser extensions, check for unexpected LaunchAgent entries and consider a full security review before accessing any cryptocurrency wallets or cloud service credentials from the affected machine.

Sources

AllSecure threat research report on DPRK macOS malvertising campaign, shared with The Hacker News, 2026. Christian Papathanasiou, co-founder and CEO of AllSecure, statement in AllSecure report, 2026. The Hacker News reporting on Contagious Interview campaign evolution, July 2026. EtherHiding technique documentation, The Hacker News, October 2025. Ethereum contract addresses rg-telemetry[.]sbs and th-updates[.]sbs, documented in AllSecure analysis.