Audit log

Every state-changing event for Lazarus Group Mach-O Man ClickFix macOS Campaign: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-01 12:41:06Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   CvZYDnumXRdJ…uQ19jA6ocopysha256 → base58

   verifying row…

   canonical bytes (21077 B) ▸

   {"actor":"system:backfill","investigation_id":"5caaf7ce-4d97-4ee9-bd46-ceeaa5d70a7d","kind":"publish","page_slug":"lazarus-group-mach-o-man-clickfix-macos-campaign","published_at":"2026-09-01T12:41:06.454Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Lazarus Group Mach-O Man ClickFix macOS Campaign","sections":[{"content":"The 'Mach-O Man' campaign is a macOS-targeted cyber intrusion operation publicly attributed to North Korea's Lazarus Group, specifically its Chollima division, according to CertiK senior blockchain security researcher Natalie Newson. The campaign was first publicly disclosed on April 21, 2026, by researcher Mauro Eldritch working with Bitso's Quetzal Team in collaboration with the ANY.RUN threat analysis platform. CoinDesk reported on April 22, 2026, that CertiK had flagged the campaign as part of an elevated Lazarus threat posture. The campaign name references the Mach-O binary format native to Apple operating systems, which the malware authors used to ensure compatibility across both Intel and Apple Silicon Macs. Attribution to Lazarus Group is based on technical indicators, tooling overlap, and the campaign's targeting profile consistent with prior North Korean intrusion sets; no independent court filing or U.S. government indictment specific to this campaign has been publicly identified as of the research date.","heading":"Campaign Overview and Attribution","severity":"critical","sources":[{"credibility":2,"name":"North Korea's Lazarus Group has a new attack vector — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik"},{"credibility":2,"name":"Lazarus 'Mach-O Man' Malware: What CISOs Need to Know — ANY.RUN","type":"research","url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/"},{"credibility":2,"name":"Lazarus Hackers Attacking macOS Users With Mach-O Man Malware Kit — CybersecurityNews","type":"news_article","url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/"}]},{"content":"The campaign employs a technique security researchers call ClickFix: victims receive unsolicited but convincing meeting invitations over Telegram, often apparently from known business contacts or colleagues, containing links to websites that impersonate Zoom, Microsoft Teams, or Google Meet. When a target visits the fraudulent site, a simulated connection error is displayed. The page instructs the visitor to open macOS Terminal and paste a command that purportedly resolves the issue. Because the victim executes the command themselves, many endpoint protection solutions do not flag the activity. The pasted command fetches and launches the first-stage Mach-O payload (teamsSDK.bin), initiating a multi-stage compromise chain. SOC Prime separately documented the related campaign under the internal name 'North Korea's Safari.'","heading":"Attack Chain and Social Engineering (ClickFix TTP)","severity":"critical","sources":[{"credibility":2,"name":"Lazarus 'Mach-O Man' Malware: What CISOs Need to Know — ANY.RUN","type":"research","url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/"},{"credibility":2,"name":"Mach-O Man Malware Hits Crypto Firms via Telegram — SOC Prime","type":"research","url":"https://socprime.com/active-threats/north-koreas-safari-campaign-delivers-rats/"},{"credibility":2,"name":"North Korea's Lazarus Targets macOS Users via ClickFix — Dark Reading","type":"news_article","url":"https://www.darkreading.com/threat-intelligence/north-koreas-lazarus-targets-macos-users-clickfix"}]},{"content":"The Mach-O Man kit is written in Go and compiled as native Mach-O binaries, enabling compatibility with both Intel and Apple Silicon hardware. Researchers at ANY.RUN identified five functional stages. Stage 1 (teamsSDK.bin, SHA-256: 871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3) serves as the stager; it downloads fraudulent macOS application bundles and applies ad-hoc code signatures via the native macOS codesign utility to bypass execution controls. Stage 2 (D1yCPUyk.bin, SHA-256: 0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90) profiles the host by querying sysctl for CPU details, hostname, boot time, network configuration, running processes, and browser extensions across Chrome, Firefox, Safari, Brave, Vivaldi, and Opera. Researchers noted a defect causing this module to enter an infinite loop, repeatedly posting system profiles to the command-and-control infrastructure and potentially exposing compromised hosts. Stage 3 (minst2.bin, SHA-256: 4b08a9e221a20b8024cf778d113732b3e12d363250231e78bae13b1f1dc1495b) establishes persistence by installing a component as 'OneDrive' at ~/.local/bin/OneDrive and registering a LaunchAgent plist at ~/Library/LaunchAgents/com.onedrive.launcher.plist for startup execution. Stage 4 deletes temporary ZIP files and application bundles before retrieving the final payload. Stage 5 is macrasv2 (SHA-256: 85bed283ba95d40d99e79437e6a3161336c94ec0acbc0cd38599d0fc9b2e393c), which aggregates browser credentials and cookies from SQLite databases, macOS Keychain entries, and browser extension data, compresses them into user_ext.zip, and exfiltrates the archive via the Telegram Bot API. The Telegram bot token was found exposed in the binary, a significant operational security failure that researchers noted could allow defenders to monitor or disrupt the exfiltration channel. Command-and-control infrastructure included IP addresses 172.86.113.102 and 144.172.114.220, and domains update-teams.live and livemicrosft.com, with C2 endpoints operating over ports 8888 and 9999. The kit also exposed WinRM, RDP, and Chrome Remote Desktop. Malware string artifacts include 'geniex-client/core', 'geniex-client/protocol', and the self-destruct message 'Die command received, initiating self-destruction,' consistent with the reported post-execution auto-deletion capability. RC4 encryption keys were recovered from the binaries.","heading":"Malware Architecture and Technical Indicators","severity":"critical","sources":[{"credibility":2,"name":"Lazarus 'Mach-O Man' Malware: What CISOs Need to Know — ANY.RUN","type":"research","url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/"},{"credibility":2,"name":"Lazarus Targets macOS Users With New Mach-O Man Malware Kit — GBHackers","type":"news_article","url":"https://gbhackers.com/lazarus-targets-macos-users/"},{"credibility":2,"name":"New Mach-O Man malware tapped by Lazarus in macOS-targeted ClickFix attacks — SC Media","type":"news_article","url":"https://www.scworld.com/brief/new-mach-o-man-malware-tapped-by-lazarus-in-macos-targeted-clickfix-attacks"}]},{"content":"The campaign is directed primarily at executives, developers, and decision-makers at cryptocurrency firms, DeFi protocols, and fintech companies — environments where macOS is widely used and where compromised credentials provide direct access to financial infrastructure and digital asset custody systems. Delivery over Telegram is consistent with prior Lazarus Group campaigns that exploit professional social networks. The targeting of Keychain data, browser sessions, and browser extension data suggests attackers seek credentials that can be used to access exchange accounts, wallet interfaces, or internal administrative systems. No specific named victim organizations have been publicly identified by Bitso's Quetzal Team or ANY.RUN in connection with confirmed compromises via this specific toolkit as of the research date.","heading":"Targeting Profile","severity":"high","sources":[{"credibility":2,"name":"North Korea's Lazarus Group targets crypto execs with new macOS malware — crypto.news","type":"news_article","url":"https://crypto.news/north-koreas-lazarus-group-targets-crypto-execs-with-new-macos-malware/"},{"credibility":2,"name":"Lazarus Group Uses Fake Meetings to Hijack Crypto Firms — CoinMarketCap","type":"news_article","url":"https://coinmarketcap.com/academy/article/lazarus-group-uses-fake-meetings-to-hijack-crypto-firms"},{"credibility":2,"name":"Lazarus Group Targets Executives with Fake Zoom, Teams Invites — Windows News","type":"news_article","url":"https://windowsnews.ai/article/lazarus-group-targets-executives-with-fake-zoom-teams-invitesmacos-malware-campaign-holds-lessons-fo.429635"}]},{"content":"CertiK researcher Natalie Newson stated that the Mach-O Man campaign emerged alongside an intensified Lazarus operational tempo. In the same month, Lazarus Group — specifically its TraderTraitor subunit — was alleged by LayerZero to be responsible for the April 18, 2026, KelpDAO bridge exploit, in which approximately $292 million in rsETH was reportedly drained by exploiting compromised internal RPC nodes to feed false data to the bridge's verification mechanism, releasing funds against a non-existent burn event. Chainalysis published a technical post-mortem of the KelpDAO exploit on April 23, 2026. A separate April 1, 2026, incident at Drift Protocol allegedly resulting in approximately $285 million in losses was also attributed to Lazarus Group by multiple security and crypto news outlets. These are attributed claims, not adjudicated findings; all attribution is based on on-chain analysis and infrastructure correlation by private investigators and LayerZero, not by a court or regulatory body. CryptoSlate reported that North Korea stole approximately $500 million from crypto in an 18-day window in April 2026, encompassing both the Drift and KelpDAO incidents. The Mach-O Man malware campaign is understood to be a credential-gathering vector operating in parallel to direct protocol-level exploits, consistent with Lazarus Group's multi-pronged approach to crypto theft documented since at least 2017.","heading":"Broader Lazarus April 2026 Operational Context","severity":"critical","sources":[{"credibility":1,"name":"LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html"},{"credibility":2,"name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":2,"name":"North Korea stole $500 million from crypto in 20 days — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/north-korea-stole-500m-from-crypto-in-18-days/"},{"credibility":2,"name":"North Korea's crypto heist playbook is expanding — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/north-korea-s-crypto-heist-playbook-is-expanding-and-defi-keeps-getting-hit"},{"credibility":2,"name":"LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor — BeInCrypto","type":"news_article","url":"https://beincrypto.com/layerzero-kelpdao-hack-lazarus-north-korea/"}]},{"content":"The ANY.RUN technical report mapped the Mach-O Man campaign to the following MITRE ATT&CK techniques: T1204 (User Execution), T1543.001 (Create or Modify System Process: Launch Agent), T1548.003 (Abuse Elevation Control Mechanism: Sudo), T1555 (Credentials from Password Stores), T1539 (Steal Web Session Cookie), and T1115 (Clipboard Data). Security researchers issued the following defensive recommendations as of April 22, 2026: organizations should block Terminal-based ClickFix lures at the endpoint level; security teams should audit LaunchAgent directories for entries masquerading as OneDrive or other Microsoft products; firms should implement application allowlisting for unsigned or ad-hoc-signed binaries; and teams should monitor for outbound connections to the identified C2 IP addresses (172.86.113.102 and 144.172.114.220) and domains (update-teams.live, livemicrosft.com). The exposed Telegram bot token, discovered in the malware binary, may provide a short-term intelligence opportunity for defenders to monitor the exfiltration channel, though the operational window is likely limited as the threat actor could rotate the token upon detection.","heading":"MITRE ATT&CK Coverage and Defensive Guidance","severity":"high","sources":[{"credibility":2,"name":"Lazarus 'Mach-O Man' Malware: What CISOs Need to Know — ANY.RUN","type":"research","url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/"},{"credibility":2,"name":"Lazarus Group & DataBreachPlus: Multi-Platform APT Campaigns — Security Arsenal","type":"research","url":"https://securityarsenal.com/blog/lazarus-group-and-databreachplus-multi-platform-apt-campaigns-involving-mach-o-man-twizadmin-and-supply-chain-attacks"}]},{"content":"Researchers documented several notable operational security failures in the Mach-O Man toolkit that may assist defenders. The Telegram bot token used for data exfiltration was embedded in plain text in the macrasv2 binary, allowing any analyst who recovered the binary to interact with or monitor the bot. C2 endpoints lacked authentication, meaning they were accessible to any party with knowledge of the IP addresses and paths. The Stage 2 profiling module contained defective code that entered infinite loops, repeatedly posting victim system profiles to C2 servers and potentially creating anomalous traffic patterns detectable by network monitoring. Ad-hoc code signatures were used instead of legitimate Apple Developer certificates, which may be flagged by more stringent macOS security policies. Several planned features, including a Google credential-stealing module, were noted to be incomplete in the analyzed samples, with internal strings reading 'Google not yet implemented.'","heading":"Operational Security Failures by Threat Actor","severity":"medium","sources":[{"credibility":2,"name":"Lazarus 'Mach-O Man' Malware: What CISOs Need to Know — ANY.RUN","type":"research","url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/"}]}],"sources_used":[{"credibility":2,"name":"North Korea's Lazarus Group has a new attack vector — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik"},{"credibility":2,"name":"Lazarus 'Mach-O Man' Malware: What CISOs Need to Know — ANY.RUN","type":"research","url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/"},{"credibility":2,"name":"Lazarus Hackers Attacking macOS Users With Mach-O Man Malware Kit — CybersecurityNews","type":"news_article","url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/"},{"credibility":2,"name":"North Korea's Lazarus Targets macOS Users via ClickFix — Dark Reading","type":"news_article","url":"https://www.darkreading.com/threat-intelligence/north-koreas-lazarus-targets-macos-users-clickfix"},{"credibility":2,"name":"New Mach-O Man malware tapped by Lazarus in macOS-targeted ClickFix attacks — SC Media","type":"news_article","url":"https://www.scworld.com/brief/new-mach-o-man-malware-tapped-by-lazarus-in-macos-targeted-clickfix-attacks"},{"credibility":2,"name":"Lazarus Targets macOS Users With New Mach-O Man Malware Kit — GBHackers","type":"news_article","url":"https://gbhackers.com/lazarus-targets-macos-users/"},{"credibility":2,"name":"Mach-O Man Malware Hits Crypto Firms via Telegram — SOC Prime","type":"research","url":"https://socprime.com/active-threats/north-koreas-safari-campaign-delivers-rats/"},{"credibility":1,"name":"LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html"},{"credibility":2,"name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":2,"name":"North Korea stole $500 million from crypto in 20 days — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/north-korea-stole-500m-from-crypto-in-18-days/"},{"credibility":2,"name":"North Korea's crypto heist playbook is expanding — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/north-korea-s-crypto-heist-playbook-is-expanding-and-defi-keeps-getting-hit"},{"credibility":2,"name":"LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor — BeInCrypto","type":"news_article","url":"https://beincrypto.com/layerzero-kelpdao-hack-lazarus-north-korea/"},{"credibility":2,"name":"Lazarus Group Targets Crypto Firms With Mach-O Man: CertiK — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/04/22/lazarus-group-targets-crypto-firms-with-mach-o-man-certik/"},{"credibility":2,"name":"Lazarus Group & DataBreachPlus: Multi-Platform APT Campaigns — Security Arsenal","type":"research","url":"https://securityarsenal.com/blog/lazarus-group-and-databreachplus-multi-platform-apt-campaigns-involving-mach-o-man-twizadmin-and-supply-chain-attacks"},{"credibility":2,"name":"North Korea's Lazarus Group targets crypto execs with new macOS malware — crypto.news","type":"news_article","url":"https://crypto.news/north-koreas-lazarus-group-targets-crypto-execs-with-new-macos-malware/"},{"credibility":2,"name":"Lazarus Group Uses Fake Meetings to Hijack Crypto Firms — CoinMarketCap","type":"news_article","url":"https://coinmarketcap.com/academy/article/lazarus-group-uses-fake-meetings-to-hijack-crypto-firms"},{"credibility":2,"name":"What Is Mach-O Man? The New Lazarus Malware Targeting Crypto and Fintech — Yahoo Tech","type":"news_article","url":"https://tech.yahoo.com/cybersecurity/articles/mach-o-man-lazarus-malware-083944340.html"}],"summary":"In April 2026, researchers at Bitso's Quetzal Team and ANY.RUN disclosed a new macOS attack campaign attributed to North Korea's Lazarus Group, dubbed 'Mach-O Man.' The campaign uses a ClickFix social engineering technique — delivering fake online meeting invitations via Telegram that trick targets into pasting malicious terminal commands — to deploy a modular, Go-compiled malware kit targeting crypto and fintech executives. CertiK's Natalie Newson publicly characterized the campaign as part of an intensified Lazarus operational tempo that also encompassed the alleged theft of over $575 million from DeFi platforms Drift Protocol and KelpDAO in April 2026.","timeline":[{"date":"2026-04-01","event":"Drift Protocol reportedly suffered a loss of approximately $285 million in an incident attributed by multiple sources to Lazarus Group, though no court or regulatory determination has been made.","source":"CryptoSlate","source_url":"https://cryptoslate.com/north-korea-stole-500m-from-crypto-in-18-days/"},{"date":"2026-04-18","event":"KelpDAO's LayerZero bridge was exploited for approximately $292 million in rsETH. LayerZero and Chainalysis attributed the exploit to Lazarus Group's TraderTraitor subunit, based on on-chain and infrastructure analysis.","source":"Yahoo Finance / LayerZero","source_url":"https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html"},{"date":"2026-04-21","event":"Bitso's Quetzal Team researcher Mauro Eldritch, in collaboration with ANY.RUN, publicly disclosed the Mach-O Man malware campaign, publishing SHA-256 hashes for all major components and network indicators of compromise.","source":"ANY.RUN Cybersecurity Blog","source_url":"https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/"},{"date":"2026-04-22","event":"CoinDesk published reporting on the Mach-O Man campaign, featuring analysis from CertiK senior researcher Natalie Newson, who characterized the campaign as converting business communications into credential theft pathways and linked it to an elevated Lazarus operational tempo.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/22/lazarus-group-has-become-especially-dangerous-with-new-mach-o-man-attack-certik"},{"date":"2026-04-22","event":"Security researchers publicly recommended defensive actions including blocking Terminal-based ClickFix lures and auditing LaunchAgent directories for OneDrive-masquerading persistence artifacts.","source":"ANY.RUN / CryptoTimes","source_url":"https://www.cryptotimes.io/2026/04/22/lazarus-group-targets-crypto-firms-with-mach-o-man-certik/"},{"date":"2026-04-23","event":"Chainalysis published a technical post-mortem of the KelpDAO bridge exploit, characterizing it as a sophisticated off-chain infrastructure attack rather than a smart contract vulnerability.","source":"Chainalysis","source_url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"date":"2026-04-29","event":"CybersecurityNews published an extended analysis of the Mach-O Man malware kit, further documenting the four-stage attack chain and confirming Mauro Eldritch and ANY.RUN as primary researchers.","source":"CybersecurityNews","source_url":"https://cybersecuritynews.com/mach-o-man-macos-malware-lazarus/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4445a3f1-6d94-4e4d-b7bc-9d895dc93173copy