Do Son 
Trojanized apps | Image: Jamf Threat Labs
At a glance
| Field | Details |
|---|---|
| Actor or Group | Suspected DPRK-affiliated operators (Contagious Interview cluster) |
| Activity Type | Malware delivery using trojanized application installers |
| Targets or Victims | Software engineers, job candidates, and Web3 developers |
| Scale | Fourteen trojanized application packages identified |
| Jurisdiction Status | Active tracking by threat researchers; no official arrests announced |
| Source | Jamf Threat Labs, Elastic Security Labs, and CITIZENDOT |
Executive Summary
Security analysts identified a cluster of fake macOS installers delivering the OtterCookie backdoor to job seekers. These malicious files impersonate trusted utilities including Bartender, The Unarchiver, and ServerCat. Furthermore, the operators share network infrastructure with previous Contagious Interview employment campaigns.
What Happened in the New Malware Campaign
Threat researchers identified fourteen malicious disk images and installer packages during a VirusTotal investigation. According to the report, “Jamf Threat Labs identified a cluster of macOS disk images (DMG) and installer packages (PKG) impersonating known Mac applications.” The attackers bundle hidden payloads inside modified copies of legitimate desktop software.
The campaign mimics fourteen separate programs. These apps include Presentify, PDFify, Magic Disk Cleaner, Sketch2026.2, SiteSucker Pro, RAR Extractor Max, and Mp3tag. Additionally, the attackers repackaged Mole, HextEdit, Folder Preview Pro, and Disk Doctor Pro.
The Architecture of the Trojanized Installers
Attackers modified the internal bundle structure of each target program. Specifically, the operators altered the Info.plist file to execute a hidden binary named .macos upon opening. This file is an x86_64 executable generated with the open-source Bunster tool. When launched, the binary removes Apple quarantine flags from the legitimate app and displays it as a decoy. Meanwhile, the background script fetches a remote payload from an external server.
In the package installer variant, the PKG drops a malicious script into the Application Support directory. Then, a postinstall routine executes the script with administrative privileges. As documented in the Jamf Threat Labs research report, the delivery chain retrieves a secondary shell script from a remote server.
Multi-Stage Payload Staging
Next, the second-stage script downloads an official Node.js runtime environment. The script requests only Intel builds, which requires Apple silicon systems to run the Rosetta 2 translation layer. Furthermore, the staging directory moved from the Documents folder to a hidden task directory in the user profile.
After acquiring Node.js, the loader downloads a script named parser.js alongside package configuration files. It then runs npm install to configure dependencies. Finally, the Node process executes the payload directly. Earlier iterations tested for virtual machine signatures. However, the operators left that check commented out in these recent files. The retrieval URLs also carry signed JSON Web Tokens to validate each session.
Who Is Behind the Intrusion Activity
Security analysts attribute this activity with moderate-to-high confidence to state-sponsored actors working for North Korea. As Jamf researchers explain, “Contagious Interview is a long-running campaign attributed to the DPRK in which attackers use a fake job interview as a pretext to convince victims to run malicious code.”
Independent investigations by CITIZENDOT and Elastic Security Labs support this attribution. Previously, these same operators delivered payloads through altered Git hooks and Visual Studio Code task files. They targeted remote job candidates by sending fake coding challenges. Now, the group expanded its operations by creating trojanized fake macOS installers to widen their reach.
The campaign infrastructure links to a live Web3 site named w3pi.social. This domain connects to a GitHub repository published in June 2026 and a public Telegram bot. The operators host their staging payloads on port 3000 of that same host.
Impact and Operational Scale
The final payload delivered by this attack chain is OtterCookie. Elastic Security Labs identified OtterCookie as a custom backdoor designed for data theft and financial gain. The malware activates four distinct internal components.
First, it creates a Socket.IO connection to an operator server for remote commands. Second, it runs an in-memory browser credential and cryptocurrency wallet harvester. Third, a local filesystem scanner searches directories for private keys and sensitive data. Fourth, a clipboard module extracts copied text using the native pbpaste tool.
Consequently, successful intrusions allow operators to steal cryptocurrency funds and proprietary code. Fortunately, the researchers observed that these installers are unsigned. Because Gatekeeper blocks unsigned code by default, victims must manually bypass security warnings to run the files. Therefore, researchers believe the group was testing these tools rather than conducting wide attacks.
What Comes Next and Defense Steps
Threat actors will likely refine their delivery mechanisms as defenders block current channels. Jamf Threat Labs concluded, “This campaign shows signs that attackers may be testing different delivery mechanisms, as seen in the disk images and packages disguised as legitimate software.” Therefore, organizations must remain alert against employment scams and unverified software.
Recommended Defense Measures
Security teams should implement several defensive controls to guard against fake macOS installers and credential theft:
- Enforce strict Gatekeeper configurations to prevent employees from executing unsigned application packages.
- Block network traffic to known staging IP addresses, specifically 162.0.239.85 and 147.124.202.205.
- Monitor endpoints for unusual background invocations of pbpaste and the Rosetta 2 translation environment.
- Train engineering staff to spot fraudulent recruiting approaches that require downloading third-party software.
- Inspect developer workstations for unauthorized hidden directories in user home folders.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
