Skip to main content
AVOID.NET

Lazarus Group Mach-O Man ClickFix macOS Campaign

avoid.net/lazarus-group-mach-o-man-clickfix-macos-campaign→0/100·91% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·3dhRFY…KCVY
Submit evidence

Summary

In April 2026, researchers at Bitso's Quetzal Team and ANY.RUN disclosed a new macOS attack campaign attributed to North Korea's Lazarus Group, dubbed 'Mach-O Man.' The campaign uses a ClickFix social engineering technique — delivering fake online meeting invitations via Telegram that trick targets into pasting malicious terminal commands — to deploy a modular, Go-compiled malware kit targeting crypto and fintech executives. CertiK's Natalie Newson publicly characterized the campaign as part of an intensified Lazarus operational tempo that also encompassed the alleged theft of over $575 million from DeFi platforms Drift Protocol and KelpDAO in April 2026.

Connected Entities

9 entities · 59 linked investigations
Organizations
□KelpDAO Bridge Exploit (April 2026)□TraderTraitor / UNC48990□Drift52□Mach-O Man Malware Campaign (Lazarus / Chollima)0□KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus0□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign0
Protocols
⌂Drift Protocol14⌂Lazarus Group Mach-O Man ClickFix macOS Campaign⌂LayerZero — DVN Single-Verifier Configuration Risk32
Relationships
  • TraderTraitor / UNC4899→mentioned with→Drift(85%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Drift(85%)
  • Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Drift(85%)
  • North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→TraderTraitor / UNC4899(70%)
  • Lazarus Group Mach-O Man ClickFix macOS Campaign→mentioned with→Drift(85%)
  • LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→TraderTraitor / UNC4899(75%)
  • Drift Protocol→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(75%)
  • KelpDAO Bridge Exploit (April 2026)→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(80%)
  • KelpDAO Bridge Exploit (April 2026)→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(75%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→TraderTraitor / UNC4899(70%)
  • + 27 more
Also appears in
June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·8ALEX Lab·52Coldcard Firmware Exploit (2026)·10Q2 2026 DeFi Record Hack Wave·0Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0Sapphire Sleet / UNC1069·2Adshares Bridge (ADS)·28Aave·81North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign·0Across Protocol·42

Connected Through

8 shared actors · 168 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Lazarus Group Mach-O Man ClickFix macOS Campaign?

Timeline(7 events)

1 April 2026

Drift Protocol reportedly suffered a loss of approximately $285 million in an incident attributed by multiple sources to Lazarus Group, though no court or regulatory determination has been made.

CryptoSlate

18 April 2026

KelpDAO's LayerZero bridge was exploited for approximately $292 million in rsETH. LayerZero and Chainalysis attributed the exploit to Lazarus Group's TraderTraitor subunit, based on on-chain and infrastructure analysis.

Yahoo Finance / LayerZero

21 April 2026

Bitso's Quetzal Team researcher Mauro Eldritch, in collaboration with ANY.RUN, publicly disclosed the Mach-O Man malware campaign, publishing SHA-256 hashes for all major components and network indicators of compromise.

ANY.RUN Cybersecurity Blog

22 April 2026

CoinDesk published reporting on the Mach-O Man campaign, featuring analysis from CertiK senior researcher Natalie Newson, who characterized the campaign as converting business communications into credential theft pathways and linked it to an elevated Lazarus operational tempo.

CoinDesk

22 April 2026

Security researchers publicly recommended defensive actions including blocking Terminal-based ClickFix lures and auditing LaunchAgent directories for OneDrive-masquerading persistence artifacts.

ANY.RUN / CryptoTimes

23 April 2026

Chainalysis published a technical post-mortem of the KelpDAO bridge exploit, characterizing it as a sophisticated off-chain infrastructure attack rather than a smart contract vulnerability.

Chainalysis

29 April 2026

CybersecurityNews published an extended analysis of the Mach-O Man malware kit, further documenting the four-stage attack chain and confirming Mauro Eldritch and ANY.RUN as primary researchers.

CybersecurityNews
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain16 Wayback Archives

Decision Log

  • #4reviewRecorded on Solana ✓9/9/2026, 3:05:06 AM
    slot 445505826 · hash 4UnY95j2faYeeeK3hyr1o3CA7RbUeswD2smzQL6f1dmV
  • #3review revise-10Recorded on Solana ✓9/2/2026, 12:42:01 AM
    slot 443562318 · hash FhuGrZYpnaZZR9PL6bobCTh3GCriPHjpxUeZZ9i47Vi8
  • #2reviewRecorded on Solana ✓9/2/2026, 12:42:01 AM
    slot 443562316 · hash DRXeH4gNA6zAntZbLR74p3SiRYRxkH5e4rTJyPKeRQk4
  • #1publishRecorded on Solana ✓9/1/2026, 12:41:06 PM
    slot 443527239 · hash CvZYDnumXRdJzVEYh3DAPt8o4yRNScjD3PrfuQ19jA6o

This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 16 of 17 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-09-0734 claims checked6 corrections pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-sonnet-4-6

generated: 9/1/2026, 12:40:56 PM

last updated: 9/2/2026, 12:42:02 AM

6 views

avoid.net — verified advice for a post-truth world