← Lazarus Group Mach-O Man macOS Campaign — 2026reviewed 2026-10-27 · 13 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Lazarus Group Mach-O Man macOS Campaign — 2026 against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
3 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in section: Scale of Lazarus Cryptocurrency Theft
“on May 6, 2022 issued its first-ever sanctions on a virtual currency mixer, which the source page identifies as Tornado Cash, citing laundering of DPRK-linked funds”
reviewerOFAC's first-ever mixer sanction (May 2022) was on Tornado CashThe cited Treasury release sanctions Blender.io. Tornado Cash was sanctioned later, in August 2022.Proposed correction (not yet applied)on May 6, 2022 issued its first-ever sanctions on a virtual currency mixer, Blender.io, citing laundering of DPRK-linked funds - #2[disputed][awaiting moderator]in the timeline
“OFAC issues its first-ever sanctions on a virtual currency mixer, identified on the source page as Tornado Cash, citing laundering of DPRK-linked proceeds.”
reviewerTimeline entry for May 2022 mixer sanction names Tornado CashSame error as the Sanctions section.Proposed correction (not yet applied)OFAC issues its first-ever sanctions on a virtual currency mixer, Blender.io, citing laundering of DPRK-linked proceeds. - #4[disputed][awaiting moderator]in section: Malware Architecture and Attack Chain
“while the merged page citing ANY.RUN describes five functional stages (counting a clean-up step separately)”
reviewerANY.RUN describes five functional stagesThe ANY.RUN source states four stages, not five. The internal 'merged page' wording is also editorial leakage.Proposed correction (not yet applied)while ANY.RUN describes four stages
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #13[unverifiable][awaiting moderator]in section: Sanctions and Regulatory Status
“On June 9, 2026, Group-IB Threat Intelligence reported ClickLock Stealer, a modular macOS stealer distributed via ClickFix phishing pages, with at least 100 victims across 33 countries since May 2026.”
reviewerGroup-IB reported ClickLock Stealer on 9 June 2026 with 100+ victims in 33 countriesNot fetched in this review. Also, the claim that the kit had been adopted by other criminal groups is only loosely supported (CoinDesk says other groups use it).
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Secondary Adoption and Related Campaigns
“T1555 (Credentials from Password Stores), T1539 (Steal Web Session Cookie) and T1115 (Clipboard Data)”
reviewerANY.RUN mapped the campaign to T1539 and T1115T1204, T1543.001, T1548.003 and T1555 match. T1539 and T1115 were not found in the ANY.RUN mapping as retrieved. The fetch was summarised, so confirm against the full page before applying the correction. - #5[partially supported][awaiting moderator]in section: Attribution and Threat Actor Background
“According to the U.S. Treasury, Lazarus Group was established by the North Korean government in 2007”
reviewerTreasury says Lazarus was established in 2007Treasury hedges with 'as early as 2007'. The page states it as a definite year. - #6[partially supported][awaiting moderator]in the timeline
“Lazarus Group established by the North Korean government, subordinate to the 110th Research Center, 3rd Bureau of the RGB, according to the U.S. Treasury.”
reviewerTimeline: Lazarus established in 2007The date field '2007' presents an upper bound as a fixed date. - #12[partially supported][awaiting moderator]in section: Linked Exploit: KelpDAO Bridge (April 2026)
“On April 18, 2026, KelpDAO's LayerZero bridge was exploited: approximately 116,500 rsETH were released against a non-existent burn event.”
reviewerDrift (about 1 April) and KelpDAO (18 April) exploit details and attributionsThe date, headline loss and attribution are consistent with search results. Granular figures were not individually verified.
confirmed
5 claimsThe cited evidence supports the claim as written.
- #7[confirmed][no action needed]in the timeline
“OFAC designates Lazarus Group, Bluenoroff and Andariel as SDNs under Executive Order 13722, prohibiting U.S. persons from transacting with them.”
reviewerOFAC designated Lazarus, Bluenoroff and Andariel on 13 September 2019 under E.O. 13722Matches the Treasury release. The conflicting April 2022 entry is flagged as a differing input, which is honest, but it is probably not a separate designation. - #8[confirmed][no action needed]in the timeline
“OFAC sanctions two Chinese nationals for laundering cryptocurrency on behalf of Lazarus Group.”
reviewerOFAC sanctioned two Chinese nationals in March 2020Confirmed. - #9[confirmed][no action needed]in the summary
“Mach-O Man is a modular, Go-compiled macOS malware kit publicly disclosed on April 21, 2026 by researcher Mauro Eldritch with Bitso's Quetzal Team and the ANY.RUN sandbox platform”
reviewerDisclosed 21 April 2026 by Mauro Eldritch with Bitso's Quetzal Team and ANY.RUNConfirmed. - #10[confirmed][no action needed]in section: Attribution and Threat Actor Background
“CertiK senior blockchain security researcher Natalie Newson publicly made this attribution.”
reviewerCertiK's Natalie Newson attributed the kit to the Chollima division and cited over $500M from Drift and KelpDAOConfirmed. Note the summary says CertiK linked the campaign to the exploits, while CoinDesk reports the $500M figure as concurrent activity. - #11[confirmed][no action needed]in section: Indicators of Compromise
“Network: C2 IP addresses 172.86.113.102 and 144.172.114.220”
reviewerC2 IPs, ports, and the hashes for teamsSDK.bin and macrasv2Spot-checked. ANY.RUN also notes a C2 replica on port 110, which the page omits.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.