{"investigation":{"slug":"lazarus-group-mach-o-man-macos-campaign-2026","entity_name":"Lazarus Group Mach-O Man macOS Campaign — 2026","trust_score":0,"severity_base":null,"score_modifier":-27,"confidence":0.92,"status":"published","content_type":"investigation","summary":"Mach-O Man is a modular, Go-compiled macOS malware kit publicly disclosed on April 21, 2026 by researcher Mauro Eldritch with Bitso's Quetzal Team and the ANY.RUN sandbox platform, and attributed to North Korea's Lazarus Group (Chollima division), an OFAC-sanctioned actor linked to the Reconnaissance General Bureau. The campaign uses ClickFix social engineering — fake Zoom, Teams or Google Meet invitations sent over Telegram — to get cryptocurrency and fintech executives and developers to paste a Terminal command that deploys a multi-stage kit stealing macOS Keychain entries, browser credentials, session cookies and wallet-extension data, exfiltrated via the Telegram Bot API. CertiK linked the campaign to an intensified Lazarus operational tempo in April 2026 that also included the alleged Drift Protocol and KelpDAO exploits, reported at roughly $500–578 million combined.","sections":[{"content":"The Mach-O Man campaign is attributed to the Lazarus Group, a North Korean state-sponsored advanced persistent threat actor linked to the Reconnaissance General Bureau (RGB), Pyongyang's primary intelligence directorate. The kit is attributed specifically to the group's Chollima division (also tracked as Famous Chollima), which has historically focused on financially motivated intrusions against cryptocurrency and financial targets; CertiK senior blockchain security researcher Natalie Newson publicly made this attribution. The group operates under numerous aliases documented by the US government and cybersecurity vendors, including Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY and Diamond Sleet. According to the U.S. Treasury, Lazarus Group was established by the North Korean government in 2007, subordinate to the 110th Research Center, 3rd Bureau of the RGB; other reporting describes the group as operational since at least 2009. It is held responsible for the 2014 Sony Pictures Entertainment breach, the 2016 Bangladesh Bank SWIFT heist, the $625 million Ronin Network hack in 2022 and the Bybit breach in early 2025 (reported as $1.5 billion or $1.46 billion). Attribution of Mach-O Man to Lazarus rests on technical indicators, tooling overlap and a targeting profile consistent with prior North Korean intrusion sets; no court filing or U.S. government indictment specific to this campaign had been publicly identified as of the research date. The malware is named after the Mach-O binary format native to macOS.","heading":"Attribution and Threat Actor Background","sources":[{"url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik","name":"CoinDesk: North Korean-backed hackers roll out new attack vector targeting crypto executives and firms","type":"news_article","credibility":1},{"url":"https://attack.mitre.org/groups/G0032/","name":"MITRE ATT&CK: Lazarus Group (G0032)","type":"research","credibility":1},{"url":"https://www.opensanctions.org/entities/NK-Xv8CnM8sgddxx7QenotGtb/","name":"OpenSanctions: Lazarus Group SDN listing","type":"regulatory","credibility":1},{"url":"https://home.treasury.gov/news/press-releases/sm774","name":"US Treasury Press Release on DPRK sanctions (2019)","type":"regulatory","credibility":1},{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","credibility":2},{"url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/","name":"CyberSecurityNews: Lazarus Hackers Attacking macOS Users With Mach-O Man Malware Kit","type":"news_article","credibility":2},{"url":"https://cyberscoop.com/bybit-lazarus-group-north-korea-ethereum/","name":"CyberScoop: Crypto Analysts Stunned by Lazarus Group's Capabilities in $1.46B Bybit Theft","type":"news_article","credibility":1}],"severity":"critical"},{"content":"The Mach-O Man kit was first publicly documented on April 21, 2026 by researcher Mauro Eldritch (described in one report as of BCA LTD and elsewhere as leading Bitso's Quetzal Team), working with Bitso's Quetzal Team and the ANY.RUN interactive sandbox platform. ANY.RUN published a detailed CISO-oriented technical breakdown including SHA-256 hashes for all major components and network indicators of compromise. The broader intrusion cluster is referred to as 'North Korea's Safari' — described on one page as the name given by the research team and on another as SOC Prime's name for the related campaign. On April 22, 2026, CoinDesk reported that CertiK analyst Natalie Newson had flagged the campaign, characterising it as converting business communications into credential-theft pathways and connecting it to a concentrated wave of Lazarus-attributed thefts in the same month, including the Drift Protocol and KelpDAO exploits. The campaign was also covered by Dark Reading, Cryptopolitan, GBHackers, CyberSecurityNews, Bitcoin News, BanklessTimes, SC Media and others; CyberSecurityNews published an extended analysis on April 29, 2026 documenting the four-stage chain and confirming Eldritch and ANY.RUN as the primary researchers.","heading":"Discovery and Public Disclosure","sources":[{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","credibility":2},{"url":"https://quetzal.bitso.com/","name":"Bitso Quetzal Team (Mauro Eldritch) — Substack","type":"research","credibility":2},{"url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik","name":"CoinDesk: North Korean-backed hackers roll out new attack vector targeting crypto executives and firms","type":"news_article","credibility":1},{"url":"https://socprime.com/active-threats/north-koreas-safari-campaign-delivers-rats/","name":"SOC Prime: Mach-O Man Malware Hits Crypto Firms via Telegram","type":"research","credibility":2},{"url":"https://gbhackers.com/lazarus-targets-macos-users/amp/","name":"GBHackers: Lazarus Targets macOS Users With New Mach-O Man Malware Kit","type":"news_article","credibility":2},{"url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/","name":"CyberSecurityNews: Lazarus Hackers Attacking macOS Users With Mach-O Man Malware Kit","type":"news_article","credibility":2}],"severity":"high"},{"content":"The campaign's initial access relies on a social engineering technique known as ClickFix, adapted here for macOS. Attackers contact targets via Telegram, frequently using accounts compromised from known colleagues or business contacts, or posing as investors, researchers or business partners, and send urgent invitations to video calls on Zoom, Microsoft Teams or Google Meet. The link leads to a fraudulent website (for example update-teams[.]live or livemicrosft[.]com) that displays a simulated connection error and instructs the victim to paste a single remediation command into the macOS Terminal. The command pulls and runs teamsSDK.bin via curl, starting the infection chain. Because the victim runs the command voluntarily, the chain needs no software vulnerability and bypasses many endpoint controls that depend on detecting exploit code. Dark Reading described the pivot to this Terminal-based approach as a significant tactical shift; it differs from earlier Lazarus macOS campaigns such as AppleJeus and RustBucket, which relied on trojanised applications or direct exploits. The use of ClickFix reflects a broader trend of social-engineering-based initial access across multiple threat actors in 2025–2026. The approach is particularly effective against cryptocurrency and fintech professionals, who routinely receive legitimate cold outreach from investors and counterparties.","heading":"Delivery Vector — ClickFix Social Engineering","sources":[{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","credibility":2},{"url":"https://www.darkreading.com/threat-intelligence/north-koreas-lazarus-targets-macos-users-clickfix","name":"Dark Reading: North Korea's Lazarus Targets macOS Users via ClickFix","type":"news_article","credibility":1},{"url":"https://www.cryptopolitan.com/lazarus-group-malware-kit-macos-crypto-execs/","name":"Cryptopolitan: Lazarus Group targets crypto, high-value execs with Mach-O Man macOS malware kit","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/lazarus-group-malware-crypto-business-execs-macos","name":"CoinTelegraph: Lazarus Group Malware Targets Crypto, Business Execs via macOS","type":"news_article","credibility":2},{"url":"https://crypto.news/lazarus-group-uses-fake-meeting-hack/","name":"crypto.news: Lazarus Group Uses Fake Meeting Hack","type":"news_article","credibility":2},{"url":"https://socprime.com/active-threats/north-koreas-safari-campaign-delivers-rats/","name":"SOC Prime: Mach-O Man Malware Hits Crypto Firms via Telegram","type":"research","credibility":2}],"severity":"critical"},{"content":"Mach-O Man is a modular kit written in Go and distributed as native Mach-O binaries compatible with both Intel x86-64 and Apple Silicon (arm64) hardware. Reports differ on the number of stages: most coverage describes four stages, while the merged page citing ANY.RUN describes five functional stages (counting a clean-up step separately). Stage 1 — Stager (teamsSDK.bin): downloads fake application bundles impersonating Zoom, Microsoft Teams or Google Meet, applies an ad-hoc signature with the macOS codesign utility, and shows a password prompt in broken English; the first two attempts trigger a window-shake animation simulating failure, and the third silently captures and transmits the credential. Stage 2 — Profiler (D1YrHRTg.bin, D1yCPUyk.bin, D1ozPVNG.bin): registers the host with the command-and-control (C2) server and collects an inventory via sysctl and native tools — hostname, UUID, CPU model, boot time, OS version, running processes, network configuration and installed browser extensions for Chrome, Firefox, Safari, Brave, Opera and Vivaldi. A defect causes some profiler instances to loop endlessly, repeatedly posting the system profile to C2 and exhausting resources, suggesting limited pre-deployment testing. Stage 3 — Persistence (minst2.bin): downloads a payload named 'localencode', saves it disguised as 'OneDrive' (reported at ~/.local/bin/OneDrive), creates a folder named 'Antivirus Service' and installs a LaunchAgent at ~/Library/LaunchAgents/com.onedrive.launcher.plist for execution at every login. A further step deletes temporary ZIP files and application bundles before the final payload is retrieved. Final stage — Stealer (macrasv2): harvests browser credentials and session cookies from SQLite databases, macOS Keychain entries, browser extension data, SSH keys and SaaS access tokens, archives them as user_ext.zip, and exfiltrates the archive via the Telegram Bot API. A self-deletion script (delete_self.sh) then removes artifacts; the binaries also contain the string 'Die command received, initiating self-destruction'. C2 traffic uses ports 8888 and 9999 and the default Go-http-client User-Agent, which aided identification.","heading":"Malware Architecture and Attack Chain","sources":[{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","credibility":2},{"url":"https://gbhackers.com/lazarus-targets-macos-users/amp/","name":"GBHackers: Lazarus Targets macOS Users With New Mach-O Man Malware Kit","type":"news_article","credibility":2},{"url":"https://gbhackers.com/lazarus-targets-macos-users/","name":"Lazarus Targets macOS Users With New Mach-O Man Malware Kit — GBHackers","type":"news_article","credibility":2},{"url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/","name":"CyberSecurityNews: Lazarus Hackers Attacking macOS Users With Mach-O Man Malware Kit","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/lazarus-group-malware-kit-macos-crypto-execs/","name":"Cryptopolitan: Lazarus Group targets crypto, high-value execs with Mach-O Man macOS malware kit","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/mach-o-man-malware-steals-macos-keychain-data-in-lazarus-group-crypto-campaign/","name":"Bitcoin News: Mach-O Man Malware Steals macOS Keychain Data in Lazarus Group Crypto Campaign","type":"news_article","credibility":2},{"url":"https://www.scworld.com/brief/new-mach-o-man-malware-tapped-by-lazarus-in-macos-targeted-clickfix-attacks","name":"New Mach-O Man malware tapped by Lazarus in macOS-targeted ClickFix attacks — SC Media","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Several features complicate detection and forensics. The malware is reported to self-delete after execution, removing key components before the victim may notice. Go compilation produces non-standard binary signatures that may evade signature-based antivirus. Ad-hoc code signatures let the initial payload pass superficial legitimacy checks without a valid Apple Developer certificate. Exfiltration via the Telegram Bot API routes stolen data through a widely trusted and allowlisted service that blends into normal corporate traffic and bypasses data-loss-prevention controls that do not inspect Telegram traffic. Because initial access relies entirely on user execution, it sidesteps exploit-based detection and shifts the forensic question from 'what exploited this system' to 'which user ran this command.' Researchers assessed the kit as substantially harder to detect with standard endpoint tooling than earlier Lazarus macOS tooling such as RustBucket.","heading":"Evasion and Detection Difficulty","sources":[{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","credibility":2},{"url":"https://news.bitcoin.com/mach-o-man-malware-steals-macos-keychain-data-in-lazarus-group-crypto-campaign/","name":"Bitcoin News: Mach-O Man Malware Steals macOS Keychain Data in Lazarus Group Crypto Campaign","type":"news_article","credibility":2}],"severity":"high"},{"content":"Indicators published by the Bitso Quetzal Team and ANY.RUN in April 2026. Network: C2 IP addresses 172.86.113.102 and 144.172.114.220; delivery domains update-teams.live and livemicrosft.com (a deliberate typosquat of 'microsoft'); C2 ports 8888 and 9999; HTTP User-Agent 'Go-http-client'. File hashes (SHA-256): teamsSDK.bin — 871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3; D1yCPUyk.bin — 0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90; minst2.bin — 4b08a9e221a20b8024cf778d113732b3e12d363250231e78bae13b1f1dc1495b; macrasv2 — 85bed283ba95d40d99e79437e6a3161336c94ec0acbc0cd38599d0fc9b2e393c. Host artifacts: ~/Library/LaunchAgents/com.onedrive.launcher.plist; an 'Antivirus Service' directory; ~/.local/bin/OneDrive; exfiltration archive user_ext.zip. String artifacts: 'geniex-client/core', 'geniex-client/protocol', 'Die command received, initiating self-destruction' and 'Google not yet implemented'. RC4 encryption keys were recovered from the binaries (values published in the ANY.RUN report). Behavioural indicators: sequential invocation of curl, Base64, gunzip, osascript and dscl from Terminal; repeated sysctl queries in rapid succession; outbound Telegram Bot API connections from macOS hosts; unauthorised access to Keychain items, browser credential stores and SSH key directories.","heading":"Indicators of Compromise","sources":[{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","credibility":2},{"url":"https://socprime.com/active-threats/north-koreas-safari-campaign-delivers-rats/","name":"SOC Prime: Mach-O Man Malware Hits Crypto Firms via Telegram","type":"research","credibility":2},{"url":"https://gbhackers.com/lazarus-targets-macos-users/","name":"Lazarus Targets macOS Users With New Mach-O Man Malware Kit — GBHackers","type":"news_article","credibility":2},{"url":"https://www.scworld.com/brief/new-mach-o-man-malware-tapped-by-lazarus-in-macos-targeted-clickfix-attacks","name":"New Mach-O Man malware tapped by Lazarus in macOS-targeted ClickFix attacks — SC Media","type":"news_article","credibility":2},{"url":"https://cybernews.com/security/north-korean-hackers-new-malware-foiled-by-researcher/","name":"Cybernews: Lazarus macOS malware foiled by C2 exploit","type":"news_article","credibility":2}],"severity":"high"},{"content":"Despite its sophistication, the toolkit contained notable OPSEC failures. The Telegram bot token used for exfiltration was embedded in plain text in the macrasv2 binary, allowing anyone who recovered it to read messages sent to and from the bot, send messages on its behalf and enumerate operator activity; researchers were able to partially observe the C2 channel and reportedly disrupt aspects of the operation. C2 endpoints lacked authentication, and infrastructure scanning revealed exposed WinRM, RDP and Chrome Remote Desktop services on attacker-controlled servers. The Stage 2 profiler's infinite loop created excessive CPU and memory use and anomalous traffic that could flag an infection. Ad-hoc signatures instead of Apple Developer certificates may be flagged by stricter macOS policies, and the default Go-http-client User-Agent is a recognisable network signature. Several planned features, including a Google credential-stealing module, were incomplete in the analysed samples, with internal strings reading 'Google not yet implemented.'","heading":"Operational Security Failures","sources":[{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","credibility":2},{"url":"https://cybernews.com/security/north-korean-hackers-new-malware-foiled-by-researcher/","name":"Cybernews: Lazarus macOS malware foiled by C2 exploit","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Documented targets are cryptocurrency developers, DeFi and fintech executives, and high-value enterprise decision-makers working primarily on macOS. Crypto and fintech organisations have disproportionately high macOS adoption among engineering and executive teams, and macOS endpoints have historically had less rigorous endpoint detection and response coverage than Windows. Attackers sought internal tools, cloud dashboards, crypto wallet seed material, exchange and wallet access and SaaS session tokens that would allow lateral movement from a compromised machine into organisational infrastructure. Delivery over Telegram with a plausible meeting pretext from an apparently known contact is consistent with prior Lazarus campaigns exploiting professional networks and with the workflow of founders and senior operators who routinely take external calls. No specific named victim organisations had been publicly identified by Bitso's Quetzal Team or ANY.RUN in connection with confirmed compromises via this toolkit as of the research date.","heading":"Target Profile","sources":[{"url":"https://www.cryptopolitan.com/lazarus-group-malware-kit-macos-crypto-execs/","name":"Cryptopolitan: Lazarus Group targets crypto, high-value execs with Mach-O Man macOS malware kit","type":"news_article","credibility":2},{"url":"https://www.banklesstimes.com/articles/2026/04/22/lazarus-unleashes-mach-o-man-macos-malware-on-crypto-and-fintech/","name":"BanklessTimes: Lazarus Unleashes Mach-O Man macOS Malware on Crypto and Fintech","type":"news_article","credibility":2},{"url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/","name":"CyberSecurityNews: Lazarus Hackers Attacking macOS Users With Mach-O Man Malware Kit","type":"news_article","credibility":2},{"url":"https://crypto.news/north-koreas-lazarus-group-targets-crypto-execs-with-new-macos-malware/","name":"Crypto.news: North Korea's Lazarus Group targets crypto execs with new macOS malware","type":"news_article","credibility":2},{"url":"https://coinmarketcap.com/academy/article/lazarus-group-uses-fake-meetings-to-hijack-crypto-firms","name":"Lazarus Group Uses Fake Meetings to Hijack Crypto Firms — CoinMarketCap","type":"news_article","credibility":2},{"url":"https://windowsnews.ai/article/lazarus-group-targets-executives-with-fake-zoom-teams-invitesmacos-malware-campaign-holds-lessons-fo.429635","name":"Lazarus Group Targets Executives with Fake Zoom, Teams Invites — Windows News","type":"news_article","credibility":2}],"severity":"high"},{"content":"On or around April 1, 2026, Drift Protocol, a Solana-based DeFi platform, suffered an exploit described as the largest DeFi hack of 2026 and the second-largest in Solana's history. Reports differ on the amount: $285 million (Bloomberg, The Hacker News, TRM Labs), $286 million (Elliptic) and $295 million (CoinDesk's report on Drift's recovery plan). The Hacker News and Bloomberg reported that the breach culminated a roughly six-month social engineering operation beginning in fall 2025: attackers posing as a quantitative trading firm attended conferences, built rapport with Drift contributors, set up a Telegram group for trading-strategy discussion and deposited over $1 million into a vault to appear legitimate. The attack involved a weaponised VS Code project with malicious tasks.json files, a fake Apple TestFlight wallet application and durable nonce manipulation. Reports differ on the responsible sub-cluster: Drift attributed the attack with medium confidence to UNC4736, a DPRK-linked cluster also tracked as AppleJeus, Citrine Sleet, Golden Chollima and Gleaming Pisces, whereas other reporting attributes it to Lazarus's TraderTraitor sub-unit. On-chain evidence reportedly linked the funds to the October 2024 Radiant Capital attack, and TRM Labs and Elliptic published analyses attributing the hack to North Korean state-sponsored actors. These are attributions by private investigators, not court or regulatory findings. Drift published a recovery plan for affected users on May 5, 2026. The Drift breach preceded the Mach-O Man disclosure by three weeks; the two are linked only in that both are attributed to Lazarus sub-clusters operating in the same window.","heading":"Linked Exploit: Drift Protocol (April 2026)","sources":[{"url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","name":"The Hacker News: $285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation","type":"news_article","credibility":1},{"url":"https://www.bloomberg.com/news/articles/2026-04-01/solana-based-defi-project-drift-hit-by-285-million-exploit","name":"Bloomberg: Drift DeFi Project on Solana Suffers $285 Million Crypto Exploit","type":"news_article","credibility":1},{"url":"https://www.trmlabs.com/resources/blog/north-korean-hackers-attack-drift-protocol-in-285-million-heist","name":"TRM Labs: North Korean Hackers Attack Drift Protocol in $285 Million Heist","type":"research","credibility":2},{"url":"https://www.elliptic.co/blog/drift-protocol-exploited-for-286-million-in-suspected-dprk-linked-attack","name":"Elliptic: Drift Protocol Exploited for $286 Million in Suspected DPRK-Linked Attack","type":"research","credibility":2},{"url":"https://www.coindesk.com/business/2026/05/05/drift-outlines-a-recovery-plan-for-users-after-usd295-million-dprk-linked-exploit","name":"CoinDesk: Drift Outlines Recovery Plan for Users After $295 Million DPRK-Linked Exploit","type":"news_article","credibility":1},{"url":"https://www.spotedcrypto.com/april-2026-crypto-hacks-lazarus-defi-crisis/","name":"SpotedCrypto: Lazarus Group Stole $578M in 18 Days","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/north-korea-stole-500m-from-crypto-in-18-days/","name":"North Korea stole $500 million from crypto in 20 days — CryptoSlate","type":"news_article","credibility":2}],"severity":"critical"},{"content":"On April 18, 2026, KelpDAO's LayerZero bridge was exploited: approximately 116,500 rsETH were released against a non-existent burn event. Reports give the loss as $290 million (BleepingComputer, UPI), $290–292 million, $290–293 million, or $292 million (Yahoo Finance). The attack targeted off-chain infrastructure rather than smart contracts: attackers allegedly compromised internal RPC nodes and ran DDoS attacks on external nodes to feed false data to the verification network. LayerZero attributed the incident to Lazarus Group, specifically its TraderTraitor subunit, and said KelpDAO's 1-of-1 DVN (Decentralized Verifier Network) setup was a single point of failure; Chainalysis corroborated the attribution and published a post-mortem, 'Inside the KelpDAO Bridge Exploit', on April 23, 2026, tracing on-chain fund flows. Stolen funds were routed through Tornado Cash. Arbitrum reportedly froze $71 million linked to the exploit, after which Lazarus was suspected of moving $175 million in ETH. These attributions rest on on-chain and infrastructure analysis by private investigators and LayerZero, not on a court or regulatory finding.","heading":"Linked Exploit: KelpDAO Bridge (April 2026)","sources":[{"url":"https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/","name":"Bleeping Computer: KelpDAO suffers $290 million heist tied to Lazarus hackers","type":"news_article","credibility":1},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Chainalysis: Inside the KelpDAO Bridge Exploit","type":"research","credibility":1},{"url":"https://www.upi.com/Top_News/World-News/2026/04/22/KelpDAO-LayerZero-North-Korea-crypto-hack-theft-Lazarus-Group/6151776848419/","name":"UPI: North Korean hackers tied to $290M crypto heist","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"CoinDesk: LayerZero Blames Kelp's Setup for $290 Million Exploit, Attributes It to North Korea's Lazarus","type":"news_article","credibility":1},{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero Says North Korea's Lazarus Likely Behind Kelp DAO Exploit","type":"news_article","credibility":1},{"url":"https://news.bitcoin.com/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit/","name":"Bitcoin News: Lazarus Group Suspected of Moving $175M in ETH After Arbitrum Freezes $71M From KelpDAO Exploit","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html","name":"LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group — Yahoo Finance","type":"news_article","credibility":1},{"url":"https://beincrypto.com/layerzero-kelpdao-hack-lazarus-north-korea/","name":"BeInCrypto: LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Reports differ on the combined April 2026 total: CertiK's Natalie Newson said more than $500 million was siphoned through the Drift and KelpDAO exploits in the two weeks before April 22; SpotedCrypto reported approximately $578 million across 18 days; CryptoSlate reported about $500 million in an 18-day window (its headline says 20 days); the merged pages summarised it as over $575 million. The Mach-O Man malware is understood to be a credential-gathering vector running in parallel with such protocol-level exploits, and the direct financial impact attributable to Mach-O Man itself had not been quantified in public reporting as of disclosure. Estimates of cumulative theft also vary: over $6 billion since 2017 (TRM Labs), $6–7 billion since 2017 (Chainalysis and TRM data cited in 2026 reports), $6.75 billion from 2019 through end-2025 (Chainalysis), and over $7.3 billion including the April 2026 exploits (CryptoTimes). Chainalysis reported DPRK-linked actors stole about $2.02 billion in 2025, a 51% year-over-year increase and roughly 76% of all service-related crypto thefts that year; separately, North Korean actors are alleged to account for 76% of global crypto hack losses in the first four months of 2026. CyberScoop's analysis of the Bybit hack noted analysts describing Lazarus as operating at 'institutional' speed and scale, and Bybit CEO Ben Zhou said the group laundered funds at a pace consistent with professional financial operations. CoinDesk described North Korea's crypto heist playbook as expanding, with DeFi repeatedly hit.","heading":"Scale of Lazarus Cryptocurrency Theft","sources":[{"url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik","name":"CoinDesk: North Korean-backed hackers roll out new attack vector targeting crypto executives and firms","type":"news_article","credibility":1},{"url":"https://www.spotedcrypto.com/april-2026-crypto-hacks-lazarus-defi-crisis/","name":"SpotedCrypto: Lazarus Group Stole $578M in 18 Days","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/north-korea-stole-500m-from-crypto-in-18-days/","name":"North Korea stole $500 million from crypto in 20 days — CryptoSlate","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/04/21/kelpdao-bybit-ronin-lazarus-groups-crypto-hacks-behind-a-7-3b-heist-empire/","name":"CryptoTimes: KelpDAO, Bybit, Ronin — Lazarus Group's Crypto Hacks Behind a $7.3B Heist Empire","type":"news_article","credibility":2},{"url":"https://cyberscoop.com/bybit-lazarus-group-north-korea-ethereum/","name":"CyberScoop: Crypto Analysts Stunned by Lazarus Group's Capabilities in $1.46B Bybit Theft","type":"news_article","credibility":1},{"url":"https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","name":"Sanctions.io: The Lazarus Group and DPRK Crypto Theft in 2026","type":"research","credibility":2},{"url":"https://www.coindesk.com/tech/2026/04/20/north-korea-s-crypto-heist-playbook-is-expanding-and-defi-keeps-getting-hit","name":"North Korea's crypto heist playbook is expanding — CoinDesk","type":"news_article","credibility":2}],"severity":"high"},{"content":"Lazarus Group is on the US Treasury OFAC Specially Designated Nationals (SDN) list. The input pages differ on the designation: one states OFAC designated Lazarus Group, Bluenoroff and Andariel on September 13, 2019 under Executive Order 13722 as agencies or instrumentalities of the North Korean government subordinate to the RGB (Treasury press release SM774); the other states OFAC placed Lazarus Group on the SDN list on April 14, 2022 under North Korea Sanctions Regulations section 510.214 (OFAC recent actions, April 2022). OFAC also sanctioned two Chinese nationals for laundering cryptocurrency for Lazarus Group on March 2, 2020, and on May 6, 2022 issued its first-ever sanctions on a virtual currency mixer, which the source page identifies as Tornado Cash, citing laundering of DPRK-linked funds. In August 2020 the US Department of Justice filed a complaint seeking forfeiture of 280 cryptocurrency addresses associated with North Korean exchange hackers, supported by Chainalysis tracing, and in 2021 three DPRK nationals were indicted for theft of $1.3 billion in cryptocurrency. A United Nations Panel of Experts report documented dozens of North Korean cyber operations over five years netting an estimated $3 billion. U.S. persons are prohibited from transacting with designated entities; anyone transferring funds to or from Lazarus Group, including inadvertently via compromised wallets or mixers that co-mingle Lazarus-attributed funds, may face secondary sanctions risk, and exchanges receiving such funds may be required to freeze them. Chainalysis and Elliptic have traced Lazarus fund flows, which typically involve rapid cross-chain bridging, mixing via Tornado Cash and similar protocols, and cash-out through OTC desks in Southeast Asia.","heading":"Sanctions and Regulatory Status","sources":[{"url":"https://home.treasury.gov/news/press-releases/sm774","name":"US Treasury Press Release on DPRK sanctions (2019)","type":"regulatory","credibility":1},{"url":"https://ofac.treasury.gov/recent-actions/20220422","name":"OFAC Treasury: Recent SDN Actions (April 2022)","type":"regulatory","credibility":1},{"url":"https://www.opensanctions.org/entities/NK-Xv8CnM8sgddxx7QenotGtb/","name":"OpenSanctions: Lazarus Group SDN listing","type":"regulatory","credibility":1},{"url":"https://home.treasury.gov/news/press-releases/sm924","name":"U.S. Treasury OFAC: Treasury Sanctions Individuals Laundering Cryptocurrency for Lazarus Group","type":"regulatory","credibility":1},{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"U.S. Treasury OFAC: First-Ever Sanctions on a Virtual Currency Mixer — Tornado Cash","type":"regulatory","credibility":1},{"url":"https://www.chainalysis.com/blog/lazarus-group-north-korea-doj-complaint-august-2020/","name":"Chainalysis: DOJ Demands Forfeiture of 280 Cryptocurrency Addresses Associated with North Korea","type":"court_filing","credibility":1},{"url":"https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","name":"Sanctions.io: The Lazarus Group and DPRK Crypto Theft in 2026","type":"research","credibility":2}],"severity":"critical"},{"content":"Researchers noted that by the time of disclosure, the kit's modular architecture had already been adopted by other cybercriminal groups beyond Lazarus, a pattern consistent with earlier Lazarus tooling diffusing into wider criminal ecosystems. On June 9, 2026, Group-IB Threat Intelligence reported ClickLock Stealer, a modular macOS stealer distributed via ClickFix phishing pages, with at least 100 victims across 33 countries since May 2026. Group-IB treated ClickLock as a distinct tool, but the overlap in delivery mechanism, target profile and platform suggests operational convergence with, or adaptation from, the Mach-O Man campaign. Security Arsenal discussed Mach-O Man alongside other multi-platform Lazarus campaigns. The campaign is assessed as part of a sustained, institutionally resourced North Korean effort to fund state activities through cryptocurrency theft rather than an isolated intrusion.","heading":"Secondary Adoption and Related Campaigns","sources":[{"url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik","name":"CoinDesk: North Korean-backed hackers roll out new attack vector targeting crypto executives and firms","type":"news_article","credibility":1},{"url":"https://rhisac.org/threat-intelligence/new-clicklock-stealer-macos-malware-spread-via-clickfix-campaign/","name":"RH-ISAC: New ClickLock Stealer macOS Malware Spread via ClickFix Campaign","type":"research","credibility":2},{"url":"https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","name":"Sanctions.io: The Lazarus Group and DPRK Crypto Theft in 2026","type":"research","credibility":2},{"url":"https://securityarsenal.com/blog/lazarus-group-and-databreachplus-multi-platform-apt-campaigns-involving-mach-o-man-twizadmin-and-supply-chain-attacks","name":"Lazarus Group & DataBreachPlus: Multi-Platform APT Campaigns — Security Arsenal","type":"research","credibility":2}],"severity":"high"},{"content":"ANY.RUN mapped the campaign to MITRE ATT&CK techniques T1204 (User Execution), T1543.001 (Launch Agent), T1548.003 (Sudo), T1555 (Credentials from Password Stores), T1539 (Steal Web Session Cookie) and T1115 (Clipboard Data). Detection guidance published from April 22, 2026: watch Terminal for sequential curl, base64 decoding, gunzip, osascript and dscl; audit ~/Library/LaunchAgents/ for unexpected plists, especially com.onedrive.launcher.plist, entries masquerading as OneDrive or other Microsoft products, or references to 'Antivirus Service'; flag outbound api.telegram.org connections from macOS hosts where Telegram is not approved; block or alert on 172.86.113.102, 144.172.114.220, update-teams.live and livemicrosft.com; flag Go-http-client User-Agent traffic; and monitor rapid successive sysctl calls. Prevention: block Terminal-based ClickFix lures at the endpoint; enforce application allow-listing against unsigned or ad-hoc-signed binaries and Gatekeeper policies requiring notarisation; restrict arbitrary Terminal commands on production endpoints; train staff that legitimate video-conferencing platforms never ask users to run Terminal commands; use phishing-resistant MFA to limit the value of stolen session tokens; and use a secrets manager or hardware security key for wallet access rather than the Keychain alone. The exposed Telegram bot token may give defenders a short-term window to monitor the exfiltration channel, though the actor could rotate it once detected.","heading":"MITRE ATT&CK Mapping, Detection and Mitigation","sources":[{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","credibility":2},{"url":"https://rhisac.org/threat-intelligence/clickfix-campaign-uses-fake-macos-utilities-to-deliver-infostealers/","name":"RH-ISAC: ClickFix Campaign Uses Fake macOS Utilities to Deliver Infostealers","type":"research","credibility":2},{"url":"https://securityarsenal.com/blog/lazarus-group-and-databreachplus-multi-platform-apt-campaigns-involving-mach-o-man-twizadmin-and-supply-chain-attacks","name":"Lazarus Group & DataBreachPlus: Multi-Platform APT Campaigns — Security Arsenal","type":"research","credibility":2},{"url":"https://www.cryptotimes.io/2026/04/22/lazarus-group-targets-crypto-firms-with-mach-o-man-certik/","name":"Lazarus Group Targets Crypto Firms With Mach-O Man: CertiK — CryptoTimes","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2007","event":"Lazarus Group established by the North Korean government, subordinate to the 110th Research Center, 3rd Bureau of the RGB, according to the U.S. Treasury.","source":"U.S. Treasury OFAC Press Release SM774","source_url":"https://home.treasury.gov/news/press-releases/sm774"},{"date":"2019-09","event":"OFAC designates Lazarus Group, Bluenoroff and Andariel as SDNs under Executive Order 13722, prohibiting U.S. persons from transacting with them.","source":"U.S. Treasury OFAC","source_url":"https://home.treasury.gov/news/press-releases/sm774"},{"date":"2020-03","event":"OFAC sanctions two Chinese nationals for laundering cryptocurrency on behalf of Lazarus Group.","source":"U.S. Treasury OFAC","source_url":"https://home.treasury.gov/news/press-releases/sm924"},{"date":"2020-08","event":"U.S. DOJ files a complaint seeking forfeiture of 280 cryptocurrency addresses linked to North Korean exchange hackers, supported by Chainalysis tracing.","source":"Chainalysis Blog","source_url":"https://www.chainalysis.com/blog/lazarus-group-north-korea-doj-complaint-august-2020/"},{"date":"2022-04","event":"OFAC places Lazarus Group on the SDN list under North Korea Sanctions Regulations section 510.214 (per one input page; see Sanctions section for the differing 2019 date).","source":"US Treasury OFAC","source_url":"https://ofac.treasury.gov/recent-actions/20220422"},{"date":"2022-05","event":"OFAC issues its first-ever sanctions on a virtual currency mixer, identified on the source page as Tornado Cash, citing laundering of DPRK-linked proceeds.","source":"U.S. Treasury OFAC","source_url":"https://home.treasury.gov/news/press-releases/jy0768"},{"date":"2025","event":"Chainalysis estimates DPRK-linked actors stole $2.02 billion during 2025, a 51% year-over-year increase.","source":"CryptoTimes / Chainalysis","source_url":"https://www.cryptotimes.io/2026/04/21/kelpdao-bybit-ronin-lazarus-groups-crypto-hacks-behind-a-7-3b-heist-empire/"},{"date":"2025-09","event":"Alleged start of a six-month social engineering operation targeting Drift Protocol, with DPRK-linked operatives attending conferences and building relationships with contributors (approximate date per reporting).","source":"The Hacker News","source_url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"},{"date":"2026-04","event":"Drift Protocol exploited for a reported $285–295 million via social engineering and durable nonce manipulation; attributed with medium confidence to UNC4736 (Citrine Sleet / Golden Chollima), with other reporting naming Lazarus's TraderTraitor sub-unit.","source":"Bloomberg / The Hacker News / TRM Labs / SpotedCrypto / CryptoSlate","source_url":"https://www.bloomberg.com/news/articles/2026-04-01/solana-based-defi-project-drift-hit-by-285-million-exploit"},{"date":"2026-04","event":"KelpDAO bridge exploited for approximately $290–293 million (about 116,500 rsETH) via compromised RPC nodes and a single-verifier DVN configuration; LayerZero and Chainalysis attribute it to Lazarus Group's TraderTraitor subunit.","source":"BleepingComputer / Chainalysis / Yahoo Finance","source_url":"https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/"},{"date":"2026-04","event":"Mauro Eldritch with Bitso's Quetzal Team and ANY.RUN publicly discloses the Mach-O Man macOS malware kit and the 'North Korea's Safari' cluster, publishing the attack chain, SHA-256 hashes and network IOCs.","source":"ANY.RUN Blog","source_url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/"},{"date":"2026-04","event":"CoinDesk publishes CertiK analyst Natalie Newson's findings linking Mach-O Man to Lazarus Group's Chollima unit and stating that over $500 million was siphoned through Drift and KelpDAO in the preceding two weeks.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik"},{"date":"2026-04","event":"Security outlets including CyberSecurityNews, GBHackers, Dark Reading, Cryptopolitan, Bitcoin News and BanklessTimes publish coverage of the Mach-O Man campaign with technical indicators.","source":"CyberSecurityNews / Dark Reading","source_url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/"},{"date":"2026-04","event":"Security researchers publicly recommend defensive actions, including blocking Terminal-based ClickFix lures and auditing LaunchAgent directories for OneDrive-masquerading persistence artifacts.","source":"ANY.RUN / CryptoTimes","source_url":"https://www.cryptotimes.io/2026/04/22/lazarus-group-targets-crypto-firms-with-mach-o-man-certik/"},{"date":"2026-04","event":"Arbitrum reportedly freezes $71 million in funds linked to the KelpDAO exploit; Lazarus is subsequently suspected of moving $175 million in ETH.","source":"Bitcoin News","source_url":"https://news.bitcoin.com/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit/"},{"date":"2026-04","event":"Chainalysis publishes a technical post-mortem of the KelpDAO bridge exploit, characterising it as an off-chain infrastructure attack rather than a smart contract vulnerability.","source":"Chainalysis","source_url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"date":"2026-04","event":"CyberSecurityNews publishes an extended analysis of the Mach-O Man kit documenting the four-stage attack chain and confirming Mauro Eldritch and ANY.RUN as primary researchers.","source":"CybersecurityNews","source_url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/"},{"date":"2026-05","event":"Drift Protocol publishes a recovery plan for users affected by the DPRK-linked exploit.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/05/05/drift-outlines-a-recovery-plan-for-users-after-usd295-million-dprk-linked-exploit"},{"date":"2026-06","event":"Group-IB Threat Intelligence reports ClickLock Stealer, a related modular macOS stealer distributed via ClickFix phishing pages, with 100+ victims across 33 countries.","source":"RH-ISAC","source_url":"https://rhisac.org/threat-intelligence/new-clicklock-stealer-macos-malware-spread-via-clickfix-campaign/"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik","name":"CoinDesk: North Korean-backed hackers roll out new attack vector targeting crypto executives and firms","type":"news_article","archive_url":"http://web.archive.org/web/20260423094320/https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik","credibility":1,"archive_timestamp":"2026-04-23T09:43:20+00:00"},{"url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","name":"ANY.RUN Blog: Lazarus Mach-O Man Malware — What CISOs Need to Know","type":"research","archive_url":"http://web.archive.org/web/20260804104834/https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/","credibility":2,"archive_timestamp":"2026-08-04T10:48:34+00:00"},{"url":"https://quetzal.bitso.com/","name":"Bitso Quetzal Team (Mauro Eldritch) — Substack","type":"research","archive_url":"http://web.archive.org/web/20260622051659/https://quetzal.bitso.com/","credibility":2,"archive_timestamp":"2026-06-22T05:16:59+00:00"},{"url":"https://gbhackers.com/lazarus-targets-macos-users/amp/","name":"GBHackers: Lazarus Targets macOS Users With New Mach-O Man Malware Kit","type":"news_article","archive_url":"http://web.archive.org/web/20260805005811/https://gbhackers.com/lazarus-targets-macos-users/amp/","credibility":2,"archive_timestamp":"2026-08-05T00:58:11+00:00"},{"url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/","name":"CyberSecurityNews: Lazarus Hackers Attacking macOS Users With Mach-O Man Malware Kit","type":"news_article","archive_url":"http://web.archive.org/web/20260429172557/https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/","credibility":2,"archive_timestamp":"2026-04-29T17:25:57+00:00"},{"url":"https://www.darkreading.com/threat-intelligence/north-koreas-lazarus-targets-macos-users-clickfix","name":"Dark Reading: North Korea's Lazarus Targets macOS Users via ClickFix","type":"news_article","archive_url":"http://web.archive.org/web/20260701210240/https://www.darkreading.com/threat-intelligence/north-koreas-lazarus-targets-macos-users-clickfix","credibility":1,"archive_timestamp":"2026-07-01T21:02:40+00:00"},{"url":"https://www.cryptopolitan.com/lazarus-group-malware-kit-macos-crypto-execs/","name":"Cryptopolitan: Lazarus Group targets crypto, high-value execs with Mach-O Man macOS malware kit","type":"news_article","archive_url":"http://web.archive.org/web/20260422193858/https://www.cryptopolitan.com/lazarus-group-malware-kit-macos-crypto-execs/","credibility":2,"archive_timestamp":"2026-04-22T19:38:58+00:00"},{"url":"https://news.bitcoin.com/mach-o-man-malware-steals-macos-keychain-data-in-lazarus-group-crypto-campaign/","name":"Bitcoin News: Mach-O Man Malware Steals macOS Keychain Data in Lazarus Group Crypto Campaign","type":"news_article","archive_url":"http://web.archive.org/web/20260423104859/https://news.bitcoin.com/mach-o-man-malware-steals-macos-keychain-data-in-lazarus-group-crypto-campaign/","credibility":2,"archive_timestamp":"2026-04-23T10:48:59+00:00"},{"url":"https://www.banklesstimes.com/articles/2026/04/22/lazarus-unleashes-mach-o-man-macos-malware-on-crypto-and-fintech/","name":"BanklessTimes: Lazarus Unleashes Mach-O Man macOS Malware on Crypto and Fintech","type":"news_article","archive_url":"http://web.archive.org/web/20260525112457/https://www.banklesstimes.com/articles/2026/04/22/lazarus-unleashes-mach-o-man-macos-malware-on-crypto-and-fintech/","credibility":2,"archive_timestamp":"2026-05-25T11:24:57+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/","name":"Bleeping Computer: KelpDAO suffers $290 million heist tied to Lazarus hackers","type":"news_article","archive_url":"http://web.archive.org/web/20260526032617/https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/","credibility":1,"archive_timestamp":"2026-05-26T03:26:17+00:00"},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Chainalysis: Inside the KelpDAO Bridge Exploit","type":"research","archive_url":"http://web.archive.org/web/20260730015225/https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","credibility":1,"archive_timestamp":"2026-07-30T01:52:25+00:00"},{"url":"https://www.upi.com/Top_News/World-News/2026/04/22/KelpDAO-LayerZero-North-Korea-crypto-hack-theft-Lazarus-Group/6151776848419/","name":"UPI: North Korean hackers tied to $290M crypto heist","type":"news_article","archive_url":"http://web.archive.org/web/20260423075046/https://www.upi.com/Top_News/World-News/2026/04/22/KelpDAO-LayerZero-North-Korea-crypto-hack-theft-Lazarus-Group/6151776848419/","credibility":1,"archive_timestamp":"2026-04-23T07:50:46+00:00"},{"url":"https://attack.mitre.org/groups/G0032/","name":"MITRE ATT&CK: Lazarus Group (G0032)","type":"research","archive_url":"http://web.archive.org/web/20260726204358/https://attack.mitre.org/groups/G0032/","credibility":1,"archive_timestamp":"2026-07-26T20:43:58+00:00"},{"url":"https://www.opensanctions.org/entities/NK-Xv8CnM8sgddxx7QenotGtb/","name":"OpenSanctions: Lazarus Group SDN listing","type":"regulatory","archive_url":"http://web.archive.org/web/20260622093336/https://www.opensanctions.org/entities/NK-Xv8CnM8sgddxx7QenotGtb/","credibility":1,"archive_timestamp":"2026-06-22T09:33:36+00:00"},{"url":"https://ofac.treasury.gov/recent-actions/20220422","name":"OFAC Treasury: Recent SDN Actions (April 2022)","type":"regulatory","archive_url":"http://web.archive.org/web/20260217213446/https://ofac.treasury.gov/recent-actions/20220422","credibility":1,"archive_timestamp":"2026-02-17T21:34:46+00:00"},{"url":"https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","name":"Sanctions.io: The Lazarus Group and DPRK Crypto Theft in 2026","type":"research","archive_url":"http://web.archive.org/web/20260727140815/https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","credibility":2,"archive_timestamp":"2026-07-27T14:08:15+00:00"},{"url":"https://rhisac.org/threat-intelligence/clickfix-campaign-uses-fake-macos-utilities-to-deliver-infostealers/","name":"RH-ISAC: ClickFix Campaign Uses Fake macOS Utilities to Deliver Infostealers","type":"research","archive_url":"http://web.archive.org/web/20260608045337/https://rhisac.org/threat-intelligence/clickfix-campaign-uses-fake-macos-utilities-to-deliver-infostealers/","credibility":2,"archive_timestamp":"2026-06-08T04:53:37+00:00"},{"url":"https://rhisac.org/threat-intelligence/new-clicklock-stealer-macos-malware-spread-via-clickfix-campaign/","name":"RH-ISAC: New ClickLock Stealer macOS Malware Spread via ClickFix Campaign","type":"research","archive_url":"https://web.archive.org/web/20260808040406/https://rhisac.org/threat-intelligence/new-clicklock-stealer-macos-malware-spread-via-clickfix-campaign/","credibility":2,"archive_timestamp":"2026-08-08T04:04:06+00:00"},{"url":"https://socprime.com/active-threats/north-koreas-safari-campaign-delivers-rats/","name":"SOC Prime: Mach-O Man Malware Hits Crypto Firms via Telegram","type":"research","archive_url":"https://web.archive.org/web/20260807154436/https://socprime.com/active-threats/north-koreas-safari-campaign-delivers-rats/","credibility":2,"archive_timestamp":"2026-08-07T15:44:36+00:00"},{"url":"https://cybernews.com/security/north-korean-hackers-new-malware-foiled-by-researcher/","name":"Cybernews: Lazarus macOS malware foiled by C2 exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260425082722/https://cybernews.com/security/north-korean-hackers-new-malware-foiled-by-researcher/","credibility":2,"archive_timestamp":"2026-04-25T08:27:22+00:00"},{"url":"https://beincrypto.com/layerzero-kelpdao-hack-lazarus-north-korea/","name":"BeInCrypto: LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor","type":"news_article","archive_url":"http://web.archive.org/web/20260725084642/https://beincrypto.com/layerzero-kelpdao-hack-lazarus-north-korea/","credibility":2,"archive_timestamp":"2026-07-25T08:46:42+00:00"},{"url":"https://crypto.news/north-koreas-lazarus-group-targets-crypto-execs-with-new-macos-malware/","name":"Crypto.news: North Korea's Lazarus Group targets crypto execs with new macOS malware","type":"news_article","archive_url":"http://web.archive.org/web/20260516170708/https://crypto.news/north-koreas-lazarus-group-targets-crypto-execs-with-new-macos-malware/","credibility":2,"archive_timestamp":"2026-05-16T17:07:08+00:00"},{"url":"https://www.spotedcrypto.com/april-2026-crypto-hacks-lazarus-defi-crisis/","name":"SpotedCrypto: Lazarus Group Stole $578M in 18 Days","type":"news_article","archive_url":"http://web.archive.org/web/20261015091153/https://www.spotedcrypto.com/april-2026-crypto-hacks-lazarus-defi-crisis/","credibility":2,"archive_timestamp":"2026-10-15T09:11:53+00:00"},{"url":"https://home.treasury.gov/news/press-releases/sm774","name":"US Treasury Press Release on DPRK sanctions (2019)","type":"regulatory","archive_url":"http://web.archive.org/web/20260604214628/https://home.treasury.gov/news/press-releases/sm774","credibility":1,"archive_timestamp":"2026-06-04T21:46:28+00:00"},{"url":"https://home.treasury.gov/news/press-releases/sm924","name":"U.S. Treasury OFAC: Treasury Sanctions Individuals Laundering Cryptocurrency for Lazarus Group","type":"regulatory","archive_url":"http://web.archive.org/web/20260529074046/https://home.treasury.gov/news/press-releases/sm924","credibility":1,"archive_timestamp":"2026-05-29T07:40:46+00:00"},{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"U.S. Treasury OFAC: First-Ever Sanctions on a Virtual Currency Mixer — Tornado Cash","type":"regulatory","archive_url":"http://web.archive.org/web/20260709144205/https://home.treasury.gov/news/press-releases/jy0768","credibility":1,"archive_timestamp":"2026-07-09T14:42:05+00:00"},{"url":"https://www.bloomberg.com/news/articles/2026-04-01/solana-based-defi-project-drift-hit-by-285-million-exploit","name":"Bloomberg: Drift DeFi Project on Solana Suffers $285 Million Crypto Exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260603054449/https://www.bloomberg.com/news/articles/2026-04-01/solana-based-defi-project-drift-hit-by-285-million-exploit","credibility":1,"archive_timestamp":"2026-06-03T05:44:49+00:00"},{"url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","name":"The Hacker News: $285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation","type":"news_article","archive_url":"http://web.archive.org/web/20260714204042/https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","credibility":1,"archive_timestamp":"2026-07-14T20:40:42+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"CoinDesk: LayerZero Blames Kelp's Setup for $290 Million Exploit, Attributes It to North Korea's Lazarus","type":"news_article","archive_url":"http://web.archive.org/web/20260526220018/https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","credibility":1,"archive_timestamp":"2026-05-26T22:00:18+00:00"},{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero Says North Korea's Lazarus Likely Behind Kelp DAO Exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260423231523/https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","credibility":1,"archive_timestamp":"2026-04-23T23:15:23+00:00"},{"url":"https://www.trmlabs.com/resources/blog/north-korean-hackers-attack-drift-protocol-in-285-million-heist","name":"TRM Labs: North Korean Hackers Attack Drift Protocol in $285 Million Heist","type":"research","archive_url":"http://web.archive.org/web/20260725171133/https://www.trmlabs.com/resources/blog/north-korean-hackers-attack-drift-protocol-in-285-million-heist","credibility":2,"archive_timestamp":"2026-07-25T17:11:33+00:00"},{"url":"https://www.elliptic.co/blog/drift-protocol-exploited-for-286-million-in-suspected-dprk-linked-attack","name":"Elliptic: Drift Protocol Exploited for $286 Million in Suspected DPRK-Linked Attack","type":"research","archive_url":"http://web.archive.org/web/20260724221544/https://www.elliptic.co/blog/drift-protocol-exploited-for-286-million-in-suspected-dprk-linked-attack","credibility":2,"archive_timestamp":"2026-07-24T22:15:44+00:00"},{"url":"https://cyberscoop.com/bybit-lazarus-group-north-korea-ethereum/","name":"CyberScoop: Crypto Analysts Stunned by Lazarus Group's Capabilities in $1.46B Bybit Theft","type":"news_article","archive_url":"http://web.archive.org/web/20260317090741/https://cyberscoop.com/bybit-lazarus-group-north-korea-ethereum/","credibility":1,"archive_timestamp":"2026-03-17T09:07:41+00:00"},{"url":"https://www.chainalysis.com/blog/lazarus-group-north-korea-doj-complaint-august-2020/","name":"Chainalysis: DOJ Demands Forfeiture of 280 Cryptocurrency Addresses Associated with North Korea","type":"court_filing","archive_url":"http://web.archive.org/web/20260413061119/https://www.chainalysis.com/blog/lazarus-group-north-korea-doj-complaint-august-2020/","credibility":1,"archive_timestamp":"2026-04-13T06:11:19+00:00"},{"url":"https://www.cryptotimes.io/2026/04/21/kelpdao-bybit-ronin-lazarus-groups-crypto-hacks-behind-a-7-3b-heist-empire/","name":"CryptoTimes: KelpDAO, Bybit, Ronin — Lazarus Group's Crypto Hacks Behind a $7.3B Heist Empire","type":"news_article","archive_url":"https://web.archive.org/web/20260726102435/https://www.cryptotimes.io/2026/04/21/kelpdao-bybit-ronin-lazarus-groups-crypto-hacks-behind-a-7-3b-heist-empire/","credibility":2,"archive_timestamp":"2026-07-26T10:24:35+00:00"},{"url":"https://www.coindesk.com/business/2026/05/05/drift-outlines-a-recovery-plan-for-users-after-usd295-million-dprk-linked-exploit","name":"CoinDesk: Drift Outlines Recovery Plan for Users After $295 Million DPRK-Linked Exploit","type":"news_article","archive_url":"https://web.archive.org/web/20260726100333/https://www.coindesk.com/business/2026/05/05/drift-outlines-a-recovery-plan-for-users-after-usd295-million-dprk-linked-exploit","credibility":1,"archive_timestamp":"2026-07-26T10:03:33+00:00"},{"url":"https://cointelegraph.com/news/lazarus-group-malware-crypto-business-execs-macos","name":"CoinTelegraph: Lazarus Group Malware Targets Crypto, Business Execs via macOS","type":"news_article","archive_url":"http://web.archive.org/web/20261023095628/https://cointelegraph.com/news/lazarus-group-malware-crypto-business-execs-macos","credibility":2,"archive_timestamp":"2026-10-23T09:56:28+00:00"},{"url":"https://crypto.news/lazarus-group-uses-fake-meeting-hack/","name":"crypto.news: Lazarus Group Uses Fake Meeting Hack","type":"news_article","archive_url":"http://web.archive.org/web/20261011160930/https://crypto.news/lazarus-group-uses-fake-meeting-hack/","credibility":2,"archive_timestamp":"2026-10-11T16:09:30+00:00"},{"url":"https://news.bitcoin.com/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit/","name":"Bitcoin News: Lazarus Group Suspected of Moving $175M in ETH After Arbitrum Freezes $71M From KelpDAO Exploit","type":"news_article","archive_url":"http://web.archive.org/web/20261023095813/https://news.bitcoin.com/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit/","credibility":2,"archive_timestamp":"2026-10-23T09:58:13+00:00"},{"url":"https://www.scworld.com/brief/new-mach-o-man-malware-tapped-by-lazarus-in-macos-targeted-clickfix-attacks","name":"New Mach-O Man malware tapped by Lazarus in macOS-targeted ClickFix attacks — SC Media","type":"news_article","archive_url":"http://web.archive.org/web/20261016200903/https://www.scworld.com/brief/new-mach-o-man-malware-tapped-by-lazarus-in-macos-targeted-clickfix-attacks","credibility":2,"archive_timestamp":"2026-10-16T20:09:03+00:00"},{"url":"https://gbhackers.com/lazarus-targets-macos-users/","name":"Lazarus Targets macOS Users With New Mach-O Man Malware Kit — GBHackers","type":"news_article","archive_url":"http://web.archive.org/web/20260805005751/https://gbhackers.com/lazarus-targets-macos-users/","credibility":2,"archive_timestamp":"2026-08-05T00:57:51+00:00"},{"url":"https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html","name":"LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group — Yahoo Finance","type":"news_article","archive_url":"http://web.archive.org/web/20260727000436/https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html","credibility":1,"archive_timestamp":"2026-07-27T00:04:36+00:00"},{"url":"https://cryptoslate.com/north-korea-stole-500m-from-crypto-in-18-days/","name":"North Korea stole $500 million from crypto in 20 days — CryptoSlate","type":"news_article","archive_url":"http://web.archive.org/web/20260525194446/https://cryptoslate.com/north-korea-stole-500m-from-crypto-in-18-days/","credibility":2,"archive_timestamp":"2026-05-25T19:44:46+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/north-korea-s-crypto-heist-playbook-is-expanding-and-defi-keeps-getting-hit","name":"North Korea's crypto heist playbook is expanding — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260422130929/https://www.coindesk.com/tech/2026/04/20/north-korea-s-crypto-heist-playbook-is-expanding-and-defi-keeps-getting-hit","credibility":2,"archive_timestamp":"2026-04-22T13:09:29+00:00"},{"url":"https://www.cryptotimes.io/2026/04/22/lazarus-group-targets-crypto-firms-with-mach-o-man-certik/","name":"Lazarus Group Targets Crypto Firms With Mach-O Man: CertiK — CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20260901182013/https://www.cryptotimes.io/2026/04/22/lazarus-group-targets-crypto-firms-with-mach-o-man-certik/","credibility":2,"archive_timestamp":"2026-09-01T18:20:13+00:00"},{"url":"https://securityarsenal.com/blog/lazarus-group-and-databreachplus-multi-platform-apt-campaigns-involving-mach-o-man-twizadmin-and-supply-chain-attacks","name":"Lazarus Group & DataBreachPlus: Multi-Platform APT Campaigns — Security Arsenal","type":"research","archive_url":"http://web.archive.org/web/20260515194419/https://securityarsenal.com/blog/lazarus-group-and-databreachplus-multi-platform-apt-campaigns-involving-mach-o-man-twizadmin-and-supply-chain-attacks","credibility":2,"archive_timestamp":"2026-05-15T19:44:19+00:00"},{"url":"https://coinmarketcap.com/academy/article/lazarus-group-uses-fake-meetings-to-hijack-crypto-firms","name":"Lazarus Group Uses Fake Meetings to Hijack Crypto Firms — CoinMarketCap","type":"news_article","archive_url":"https://web.archive.org/web/20260901181216/https://coinmarketcap.com/academy/article/lazarus-group-uses-fake-meetings-to-hijack-crypto-firms","credibility":2,"archive_timestamp":"2026-09-01T18:12:16+00:00"},{"url":"https://tech.yahoo.com/cybersecurity/articles/mach-o-man-lazarus-malware-083944340.html","name":"What Is Mach-O Man? The New Lazarus Malware Targeting Crypto and Fintech — Yahoo Tech","type":"news_article","archive_url":"https://web.archive.org/web/20260901152910/https://tech.yahoo.com/cybersecurity/articles/mach-o-man-lazarus-malware-083944340.html","credibility":2,"archive_timestamp":"2026-09-01T15:29:10+00:00"},{"url":"https://windowsnews.ai/article/lazarus-group-targets-executives-with-fake-zoom-teams-invitesmacos-malware-campaign-holds-lessons-fo.429635","name":"Lazarus Group Targets Executives with Fake Zoom, Teams Invites — Windows News","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-08-07T12:26:01.955595+00:00","updated_at":"2026-11-06T13:18:16.371171+00:00"},"source_quality":{"total":49,"tier1":4,"tier2":11,"tier3":0,"unrated":34},"follower_count":null,"content_updated_at":"2026-10-27T19:04:59.635Z","last_fact_checked_at":"2026-10-27T19:04:59.384Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}