Lazarus Group Mach-O Man macOS Campaign — 2026
Last changed 2026-10-27 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2C5bUa…W87ASummary
Mach-O Man is a modular, Go-compiled macOS malware kit publicly disclosed on April 21, 2026 by researcher Mauro Eldritch with Bitso's Quetzal Team and the ANY.RUN sandbox platform, and attributed to North Korea's Lazarus Group (Chollima division), an OFAC-sanctioned actor linked to the Reconnaissance General Bureau. The campaign uses ClickFix social engineering — fake Zoom, Teams or Google Meet invitations sent over Telegram — to get cryptocurrency and fintech executives and developers to paste a Terminal command that deploys a multi-stage kit stealing macOS Keychain entries, browser credentials, session cookies and wallet-extension data, exfiltrated via the Telegram Bot API. CertiK linked the campaign to an intensified Lazarus operational tempo in April 2026 that also included the alleged Drift Protocol and KelpDAO exploits, reported at roughly $500–578 million combined.
Connected Entities
15 entities · 60 linked investigations- KelpDAO Bridge Exploit (April 2026)→mentioned with→Arbitrum(80%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Bitcoin(80%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Arbitrum(70%)
- TraderTraitor / UNC4899→mentioned with→Drift(85%)
- TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Drift(85%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Solana(60%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Arbitrum(65%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Solana(65%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Drift(85%)
- + 64 more
Timeline(19 events)
2007
Lazarus Group established by the North Korean government, subordinate to the 110th Research Center, 3rd Bureau of the RGB, according to the U.S. Treasury.
U.S. Treasury OFAC Press Release SM774September 2019
OFAC designates Lazarus Group, Bluenoroff and Andariel as SDNs under Executive Order 13722, prohibiting U.S. persons from transacting with them.
U.S. Treasury OFACMarch 2020
OFAC sanctions two Chinese nationals for laundering cryptocurrency on behalf of Lazarus Group.
U.S. Treasury OFACAugust 2020
U.S. DOJ files a complaint seeking forfeiture of 280 cryptocurrency addresses linked to North Korean exchange hackers, supported by Chainalysis tracing.
Chainalysis BlogApril 2022
OFAC places Lazarus Group on the SDN list under North Korea Sanctions Regulations section 510.214 (per one input page; see Sanctions section for the differing 2019 date).
US Treasury OFACMay 2022
OFAC issues its first-ever sanctions on a virtual currency mixer, identified on the source page as Tornado Cash, citing laundering of DPRK-linked proceeds.
U.S. Treasury OFAC2025
Chainalysis estimates DPRK-linked actors stole $2.02 billion during 2025, a 51% year-over-year increase.
CryptoTimes / ChainalysisSeptember 2025
Alleged start of a six-month social engineering operation targeting Drift Protocol, with DPRK-linked operatives attending conferences and building relationships with contributors (approximate date per reporting).
The Hacker NewsApril 2026
Drift Protocol exploited for a reported $285–295 million via social engineering and durable nonce manipulation; attributed with medium confidence to UNC4736 (Citrine Sleet / Golden Chollima), with other reporting naming Lazarus's TraderTraitor sub-unit.
Bloomberg / The Hacker News / TRM Labs / SpotedCrypto / CryptoSlateApril 2026
KelpDAO bridge exploited for approximately $290–293 million (about 116,500 rsETH) via compromised RPC nodes and a single-verifier DVN configuration; LayerZero and Chainalysis attribute it to Lazarus Group's TraderTraitor subunit.
BleepingComputer / Chainalysis / Yahoo FinanceApril 2026
Mauro Eldritch with Bitso's Quetzal Team and ANY.RUN publicly discloses the Mach-O Man macOS malware kit and the 'North Korea's Safari' cluster, publishing the attack chain, SHA-256 hashes and network IOCs.
ANY.RUN BlogApril 2026
CoinDesk publishes CertiK analyst Natalie Newson's findings linking Mach-O Man to Lazarus Group's Chollima unit and stating that over $500 million was siphoned through Drift and KelpDAO in the preceding two weeks.
CoinDeskApril 2026
Security outlets including CyberSecurityNews, GBHackers, Dark Reading, Cryptopolitan, Bitcoin News and BanklessTimes publish coverage of the Mach-O Man campaign with technical indicators.
CyberSecurityNews / Dark ReadingApril 2026
Security researchers publicly recommend defensive actions, including blocking Terminal-based ClickFix lures and auditing LaunchAgent directories for OneDrive-masquerading persistence artifacts.
ANY.RUN / CryptoTimesApril 2026
Arbitrum reportedly freezes $71 million in funds linked to the KelpDAO exploit; Lazarus is subsequently suspected of moving $175 million in ETH.
Bitcoin NewsApril 2026
Chainalysis publishes a technical post-mortem of the KelpDAO bridge exploit, characterising it as an off-chain infrastructure attack rather than a smart contract vulnerability.
ChainalysisApril 2026
CyberSecurityNews publishes an extended analysis of the Mach-O Man kit documenting the four-stage attack chain and confirming Mauro Eldritch and ANY.RUN as primary researchers.
CybersecurityNewsMay 2026
Drift Protocol publishes a recovery plan for users affected by the DPRK-linked exploit.
CoinDeskJune 2026
Group-IB Threat Intelligence reports ClickLock Stealer, a related modular macOS stealer distributed via ClickFix phishing pages, with 100+ victims across 33 countries.
RH-ISACDecision Log
- slot 462182573 · hash Epk6EffUE99dGs3zVTxGWcsWn3cyV4Qy7Kzpn9rWuJPQ
- slot 462182567 · hash 3Uy5EbfLa6xdavfAAF7QfH7Pf4fftkB1BSYY5giFZ4kf
- slot 457587706 · hash Ec7b3JF5rvnc4wKUkvtCz9mW67vVCvMFESea3vCLBC75
- slot 457583762 · hash 6p2NLWWkGcrY4BNWHaH29UzVmN2imGEmwz8wSxbjKw9x
- slot 443519372 · hash 4ZTrFTT4HsWoiQ1unMZXRttwdJoHzzWGUoG26inVYNUH
- slot 443519348 · hash 7GCYtySTrpyzwtAskXEZrQxViydUQJYyviuycSadb4Pw
- slot 443504700 · hash 97dYL5p7Pbz9MHu5GUBJhuysAbkPnXFFn7tx9uy1w8T4
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 47 of 49 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/7/2026, 12:26:01 PM
last updated: 10/27/2026, 7:04:59 PM
6 viewsavoid.net — verified advice for a post-truth world