← Lazarus Group Mach-O Man ClickFix macOS Campaignreviewed 2026-09-07 · 34 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Lazarus Group Mach-O Man ClickFix macOS Campaign against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
5 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #11[disputed][awaiting moderator]in section: Malware Architecture and Technical Indicators
“Researchers at ANY.RUN identified five functional stages.”
reviewerResearchers at ANY.RUN identified five functional stages in the Mach-O Man kitEvery source consulted, including the cited ANY.RUN report and the page's own timeline entry, describes four stages, not five. The page appears to have manufactured an extra 'Stage 4' cleanup step that is actually part of the persistence stage in the source material.Proposed correction (not yet applied)Researchers at ANY.RUN identified four functional stages. - #12[disputed][awaiting moderator]in section: Malware Architecture and Technical Indicators
“Stage 4 deletes temporary ZIP files and application bundles before retrieving the final payload.”
reviewerThe malware kit's cleanup routine (deleting temporary ZIP files/app bundles) constitutes a distinct 'Stage 4' preceding the final payloadSame underlying miscount as the 'five functional stages' claim; the cleanup step belongs to Stage 3 per the source.Proposed correction (not yet applied)As part of the persistence stage (Stage 3), the module deletes temporary ZIP files and application bundles before retrieving the final payload. - #13[disputed][awaiting moderator]in section: Malware Architecture and Technical Indicators
“Stage 5 is macrasv2”
reviewerThe final credential-stealing payload macrasv2 is 'Stage 5' of the attack chainSame underlying stage-count miscount; macrasv2's SHA-256 hash is correctly reported, only its stage number is wrong.Proposed correction (not yet applied)Stage 4 is macrasv2 - #24[disputed][awaiting moderator]in section: Broader Lazarus April 2026 Operational Context
“an 18-day window in April 2026”
reviewerCryptoSlate reported North Korea stole approximately $500 million from crypto in an 18-day window in April 2026The cited source's actual headline and text state a ~20-day/three-week window, not 18 days; the page appears to have taken the figure from the URL slug rather than the article's stated content.Proposed correction (not yet applied)a roughly three-week (approximately 20-day) window in April 2026 - #25[disputed][awaiting moderator]in section: MITRE ATT&CK Coverage and Defensive Guidance
“The ANY.RUN technical report mapped the Mach-O Man campaign to the following MITRE ATT&CK techniques: T1204 (User Execution), T1543.001 (Create or Modify System Process: Launch Agent), T1548.003 (Abuse Elevation Control Mechanism: Sudo), T1555 (Credentials from Password Stores), T1539 (Steal Web Session Cookie), and T1115 (Clipboard Data).”
reviewerThe ANY.RUN technical report mapped the campaign to MITRE ATT&CK techniques T1204, T1543.001, T1548.003, T1555, T1539, and T1115Four of the six cited technique IDs are correct, but T1539 and T1115 are not present in the cited ANY.RUN report and appear to be fabricated or confused with a different framework mapping.Proposed correction (not yet applied)The ANY.RUN technical report mapped the Mach-O Man campaign to the following MITRE ATT&CK techniques: T1204 (User Execution), T1543.001 (Create or Modify System Process: Launch Agent), T1548.003 (Abuse Elevation Control Mechanism: Sudo and Sudo Caching), T1222 (File and Directory Permissions Modification), T1497 (Virtualization/Sandbox Evasion), T1555 (Credentials from Password Stores), T1552 (Unsecured Credentials), T1082 (System Information Discovery), T1057 (Process Discovery), T1124 (System Time Discovery), T1083 (File and Directory Discovery), T1005 (Data from Local System), T1560 (Archive Collected Data), and T1567 (Exfiltration Over Web Service).
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in section: Campaign Overview and Attribution
“no independent court filing or U.S. government indictment specific to this campaign has been publicly identified as of the research date”
reviewerNo independent court filing or U.S. government indictment specific to this campaign has been publicly identifiedA negative/absence claim; no contradicting indictment was found, but this cannot be exhaustively verified against all court dockets. - #19[unverifiable][awaiting moderator]in section: Targeting Profile
“No specific named victim organizations have been publicly identified by Bitso's Quetzal Team or ANY.RUN in connection with confirmed compromises via this specific toolkit as of the research date.”
reviewerNo specific named victim organizations have been publicly identified by Bitso's Quetzal Team or ANY.RUN in connection with confirmed compromises via this specific toolkitA negative/absence claim about victim disclosure; no named-victim reporting was found, but this cannot be exhaustively confirmed.
link rot
1 claimA cited source no longer resolves or no longer says what the page attributes to it.
- #20[link rot][awaiting moderator]in section: Targeting Profile
“https://windowsnews.ai/article/lazarus-group-targets-executives-with-fake-zoom-teams-invitesmacos-malware-campaign-holds-lessons-fo.429635”
reviewerwindowsnews.ai article is a valid, live source supporting the targeting-profile sectionThe windowsnews.ai URL no longer resolves to its original domain/content; the redirect target is inaccessible. This source is also absent from the page's top-level sources_used list despite being cited inline in this section.
confirmed
26 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“In April 2026, researchers at Bitso's Quetzal Team and ANY.RUN disclosed a new macOS attack campaign attributed to North Korea's Lazarus Group, dubbed 'Mach-O Man.'”
reviewerBitso's Quetzal Team and ANY.RUN disclosed a new macOS attack campaign attributed to Lazarus Group, dubbed 'Mach-O Man', in April 2026Multiple independent tier-1/2 sources confirm the disclosure, naming, and attribution as described. - #2[confirmed][no action needed]in the summary
“The campaign uses a ClickFix social engineering technique — delivering fake online meeting invitations via Telegram that trick targets into pasting malicious terminal commands — to deploy a modular, Go-compiled malware kit targeting crypto and fintech executives.”
reviewerThe campaign uses ClickFix social engineering (fake meeting invites via Telegram, terminal command paste) to deploy a modular Go-compiled malware kit targeting crypto/fintech executivesDescription matches source reporting closely. - #3[confirmed][no action needed]in the summary
“CertiK's Natalie Newson publicly characterized the campaign as part of an intensified Lazarus operational tempo that also encompassed the alleged theft of over $575 million from DeFi platforms Drift Protocol and KelpDAO in April 2026.”
reviewerCertiK's Natalie Newson characterized the campaign as part of an intensified Lazarus operational tempo including over $575 million stolen from Drift Protocol and KelpDAO in April 2026The $575M figure (285M + 292M ≈ 577M, reported elsewhere as 'at least $575 million') is corroborated by independent reporting. - #4[confirmed][no action needed]in section: Campaign Overview and Attribution
“The campaign was first publicly disclosed on April 21, 2026, by researcher Mauro Eldritch working with Bitso's Quetzal Team in collaboration with the ANY.RUN threat analysis platform.”
reviewerThe campaign was first publicly disclosed on April 21, 2026, by Mauro Eldritch working with Bitso's Quetzal Team in collaboration with ANY.RUNWidely corroborated April 21, 2026 date for the joint 'Mach-O Man' disclosure; an earlier, differently-named Substack post by the same researcher ('North Korea's Safari') exists but does not contradict this specific disclosure date for the ANY.RUN-branded report. - #5[confirmed][no action needed]in section: Campaign Overview and Attribution
“CoinDesk reported on April 22, 2026, that CertiK had flagged the campaign as part of an elevated Lazarus threat posture.”
reviewerCoinDesk reported on April 22, 2026, that CertiK had flagged the campaign as part of an elevated Lazarus threat posturePublication date embedded in URL and corroborated by search snippets. - #6[confirmed][no action needed]in section: Campaign Overview and Attribution
“The 'Mach-O Man' campaign is a macOS-targeted cyber intrusion operation publicly attributed to North Korea's Lazarus Group, specifically its Chollima division, according to CertiK senior blockchain security researcher Natalie Newson.”
reviewerAttribution to Lazarus Group is specifically to its Chollima division, per CertiK's Natalie NewsonChollima/Famous Chollima attribution recurs across multiple independent write-ups of this campaign. - #8[confirmed][no action needed]in section: Attack Chain and Social Engineering (ClickFix TTP)
“SOC Prime separately documented the related campaign under the internal name 'North Korea's Safari.'”
reviewerSOC Prime separately documented the related campaign under the internal name 'North Korea's Safari'Confirmed the alternate campaign label refers to the same activity. - #9[confirmed][no action needed]in section: Attack Chain and Social Engineering (ClickFix TTP)
“The pasted command fetches and launches the first-stage Mach-O payload (teamsSDK.bin), initiating a multi-stage compromise chain.”
reviewerThe pasted terminal command fetches and launches the first-stage Mach-O payload named teamsSDK.binMatches source exactly. - #10[confirmed][no action needed]in section: Malware Architecture and Technical Indicators
“Stage 1 (teamsSDK.bin, SHA-256: 871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3) serves as the stager”
reviewerSHA-256 hashes for teamsSDK.bin, D1yCPUyk.bin, minst2.bin, and macrasv2 as listed on the pageHash values verified character-for-character against the cited primary source. - #14[confirmed][no action needed]in section: Malware Architecture and Technical Indicators
“Command-and-control infrastructure included IP addresses 172.86.113.102 and 144.172.114.220, and domains update-teams.live and livemicrosft.com, with C2 endpoints operating over ports 8888 and 9999.”
reviewerC2 infrastructure included IPs 172.86.113.102 and 144.172.114.220 and domains update-teams.live and livemicrosft.com, operating over ports 8888 and 9999IP/domain IOCs verified against primary source. - #15[confirmed][no action needed]in section: Malware Architecture and Technical Indicators
“The kit also exposed WinRM, RDP, and Chrome Remote Desktop.”
reviewerThe kit exposed WinRM, RDP, and Chrome Remote Desktop servicesDirectly confirmed. - #16[confirmed][no action needed]in section: Malware Architecture and Technical Indicators
“Malware string artifacts include 'geniex-client/core', 'geniex-client/protocol', and the self-destruct message 'Die command received, initiating self-destruction,' consistent with the reported post-execution auto-deletion capability. RC4 encryption keys were recovered from the binaries.”
reviewerMalware strings include 'geniex-client/core', 'geniex-client/protocol', and the self-destruct message 'Die command received, initiating self-destruction'; RC4 encryption keys were recoveredVerified verbatim against the primary technical report. - #17[confirmed][no action needed]in section: Malware Architecture and Technical Indicators
“Researchers noted a defect causing this module to enter an infinite loop, repeatedly posting system profiles to the command-and-control infrastructure and potentially exposing compromised hosts.”
reviewerStage 2 (D1yCPUyk.bin) contains a defect causing an infinite loop that repeatedly posts system profiles to C2Confirmed via both the primary ANY.RUN research and independent reporting. - #18[confirmed][no action needed]in section: Targeting Profile
“The campaign is directed primarily at executives, developers, and decision-makers at cryptocurrency firms, DeFi protocols, and fintech companies”
reviewerThe campaign targets executives, developers, and decision-makers at crypto/DeFi/fintech firms, with no named victims publicly confirmedTargeting profile description is consistent across independent sources. - #21[confirmed][no action needed]in section: Broader Lazarus April 2026 Operational Context
“In the same month, Lazarus Group — specifically its TraderTraitor subunit — was alleged by LayerZero to be responsible for the April 18, 2026, KelpDAO bridge exploit, in which approximately $292 million in rsETH was reportedly drained by exploiting compromised internal RPC nodes to feed false data to the bridge's verification mechanism, releasing funds against a non-existent burn event.”
reviewerKelpDAO's LayerZero bridge was exploited on April 18, 2026 for approximately $292 million in rsETH, attributed by LayerZero to Lazarus Group's TraderTraitor subunit via RPC node compromiseDate, amount, mechanism, and attribution all independently corroborated. - #22[confirmed][no action needed]in section: Broader Lazarus April 2026 Operational Context
“Chainalysis published a technical post-mortem of the KelpDAO exploit on April 23, 2026.”
reviewerChainalysis published a technical post-mortem of the KelpDAO exploit on April 23, 2026Substance of the Chainalysis analysis matches; specific publish date plausible and uncontradicted. - #23[confirmed][no action needed]in section: Broader Lazarus April 2026 Operational Context
“A separate April 1, 2026, incident at Drift Protocol allegedly resulting in approximately $285 million in losses was also attributed to Lazarus Group by multiple security and crypto news outlets.”
reviewerA separate April 1, 2026 incident at Drift Protocol resulted in approximately $285 million in losses, attributed to Lazarus Group by multiple outletsDate and amount independently confirmed. - #26[confirmed][no action needed]in section: MITRE ATT&CK Coverage and Defensive Guidance
“Security researchers issued the following defensive recommendations as of April 22, 2026: organizations should block Terminal-based ClickFix lures at the endpoint level; security teams should audit LaunchAgent directories for entries masquerading as OneDrive or other Microsoft products; firms should implement application allowlisting for unsigned or ad-hoc-signed binaries; and teams should monitor for outbound connections to the identified C2 IP addresses”
reviewerSecurity researchers issued defensive recommendations on April 22, 2026 including blocking ClickFix lures, auditing LaunchAgent directories, application allowlisting, and monitoring identified C2 indicatorsGeneral recommendations are consistent with the technical characteristics of the malware described elsewhere in the page. - #27[confirmed][no action needed]in section: MITRE ATT&CK Coverage and Defensive Guidance
“The exposed Telegram bot token, discovered in the malware binary, may provide a short-term intelligence opportunity for defenders to monitor the exfiltration channel, though the operational window is likely limited as the threat actor could rotate the token upon detection.”
reviewerThe exposed Telegram bot token could allow defenders to monitor the exfiltration channel, though the window is limited by potential token rotationReasonable inference directly supported by the primary technical source. - #28[confirmed][no action needed]in section: Operational Security Failures by Threat Actor
“Several planned features, including a Google credential-stealing module, were noted to be incomplete in the analyzed samples, with internal strings reading 'Google not yet implemented.'”
reviewerOperational security failures included plaintext bot token exposure, unauthenticated C2 endpoints, the Stage 2 infinite-loop bug, ad-hoc code signing, and an incomplete Google credential-stealing module with the string 'Google not yet implemented'All operational-security failure details verified against the primary technical source. - #29[confirmed][no action needed]in the timeline
“Drift Protocol reportedly suffered a loss of approximately $285 million in an incident attributed by multiple sources to Lazarus Group, though no court or regulatory determination has been made.”
reviewerTimeline: Drift Protocol reportedly suffered a ~$285 million loss on 2026-04-01, attributed to Lazarus GroupDate and figure independently confirmed. - #30[confirmed][no action needed]in the timeline
“KelpDAO's LayerZero bridge was exploited for approximately $292 million in rsETH. LayerZero and Chainalysis attributed the exploit to Lazarus Group's TraderTraitor subunit, based on on-chain and infrastructure analysis.”
reviewerTimeline: KelpDAO's LayerZero bridge exploited for ~$292 million in rsETH on 2026-04-18, attributed to TraderTraitorMatches independent reporting exactly. - #31[confirmed][no action needed]in the timeline
“Bitso's Quetzal Team researcher Mauro Eldritch, in collaboration with ANY.RUN, publicly disclosed the Mach-O Man malware campaign, publishing SHA-256 hashes for all major components and network indicators of compromise.”
reviewerTimeline: Mauro Eldritch/Bitso's Quetzal Team with ANY.RUN disclosed the campaign on 2026-04-21, publishing SHA-256 hashes and IOCsConsistent with other April 21-22, 2026 reporting on the same disclosure. - #32[confirmed][no action needed]in the timeline
“CoinDesk published reporting on the Mach-O Man campaign, featuring analysis from CertiK senior researcher Natalie Newson, who characterized the campaign as converting business communications into credential theft pathways and linked it to an elevated Lazarus operational tempo.”
reviewerTimeline: CoinDesk published reporting on 2026-04-22 featuring CertiK's Natalie Newson linking the campaign to elevated Lazarus operational tempoConfirmed via search corroboration; direct fetch of the CoinDesk URL was rate-limited (HTTP 429) during this review. - #33[confirmed][no action needed]in the timeline
“Chainalysis published a technical post-mortem of the KelpDAO bridge exploit, characterizing it as a sophisticated off-chain infrastructure attack rather than a smart contract vulnerability.”
reviewerTimeline: Chainalysis published a KelpDAO post-mortem on 2026-04-23Substance confirmed; precise publication date plausible. - #34[confirmed][no action needed]in the timeline
“CybersecurityNews published an extended analysis of the Mach-O Man malware kit, further documenting the four-stage attack chain and confirming Mauro Eldritch and ANY.RUN as primary researchers.”
reviewerTimeline: CybersecurityNews published an extended analysis on 2026-04-29 documenting a four-stage attack chainThis timeline entry's 'four-stage attack chain' is itself the correct stage count, and directly contradicts the page's own 'five functional stages' claim in the Malware Architecture section (see mach-o-man-stage-count defect group).
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.