14 Fake macOS Installers Linked to DPRK Campaign Deliver Credential-Stealing RAT

Mac users are being targeted with 14 fake application installers that appear to offer familiar software but instead start a credential-stealing remote-access trojan. The files were distributed as macOS disk images and installer packages, giving attackers another route into systems used by developers and job seekers. The activity is tied to the long-running Contagious Interview campaign, in which attackers pose as recruiters and send coding tests, repositories or packages to prospective candidates. This latest wave moves the lure outside the usual developer workflow and hides the infection inside software installers. Jamf Threat Labs identified the installer cluster and linked its staging infrastructure to earlier Git-hook and Visual Studio Code task-file attacks. The final payload is OtterCookie, a remote-access trojan that can take browser and cryptocurrency-wallet credentials, search for sensitive files and monitor clipboard data. The risk is not limited to a single fake download. A victim who bypasses macOS warnings can…