Mach-O Man Malware Campaign (Lazarus / Chollima)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5cwuYS…pjzHSummary
Mach-O Man is a four-stage macOS malware kit attributed to North Korea's Lazarus Group (Chollima division), publicly disclosed in April 2026 by researchers at Bitso's Quetzal Team and the ANY.RUN sandbox platform. The campaign uses ClickFix social engineering — delivering fake meeting invitations via Telegram — to trick cryptocurrency and fintech executives into executing a terminal command that deploys a modular toolkit capable of stealing macOS Keychain secrets, browser credentials, session cookies, and crypto wallet extension data. Security researchers have linked the same threat actor cluster to over $575 million stolen from Drift Protocol and KelpDAO in April 2026 alone, and Lazarus Group's cumulative cryptocurrency theft since 2017 is estimated to exceed $7.3 billion.
Connected Entities
10 entities · 60 linked investigations- KelpDAO Bridge Exploit (April 2026)→mentioned with→Arbitrum(80%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Arbitrum(70%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Drift(85%)
- KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Solana(60%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Arbitrum(65%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Solana(65%)
- Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Drift(85%)
- Drift Protocol→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(75%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(80%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(75%)
- + 31 more
Connected Through
10 shared actors · 609 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Solanaorganization
- □Arbitrumorganization
- □North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaignorganization
- ⌂LayerZero — DVN Single-Verifier Configuration Riskprotocol
Timeline(13 events)
2007
Lazarus Group established by the North Korean government, subordinate to the 110th Research Center, 3rd Bureau of the RGB, according to U.S. Treasury.
U.S. Treasury OFAC Press Release SM77413 September 2019
OFAC designates Lazarus Group, Bluenoroff, and Andariel as SDNs under Executive Order 13722, prohibiting U.S. persons from transacting with them.
U.S. Treasury OFAC2 March 2020
OFAC sanctions two Chinese nationals for laundering cryptocurrency on behalf of Lazarus Group.
U.S. Treasury OFACAugust 2020
U.S. DOJ files complaint seeking forfeiture of 280 cryptocurrency addresses linked to North Korean exchange hackers, supported by Chainalysis tracing.
Chainalysis Blog6 May 2022
OFAC issues first-ever sanctions on a virtual currency mixer (Tornado Cash) citing its use to launder DPRK-linked proceeds.
U.S. Treasury OFAC2025
Chainalysis estimates DPRK-linked actors stole $2.02 billion during 2025, a 51% year-over-year increase, per its 2026 crypto crime report.
CryptoTimes / ChainalysisSeptember 2025
Alleged start of six-month social engineering operation targeting Drift Protocol, with DPRK-linked operatives attending conferences and building relationships with contributors (approximate date per reporting).
The Hacker NewsApril 2026
Drift Protocol exploited for approximately $285–295 million via social engineering and durable nonce manipulation. Attributed with medium confidence to UNC4736 (Citrine Sleet / Golden Chollima), a DPRK-linked cluster.
Bloomberg / The Hacker News / TRM Labs18 April 2026
KelpDAO bridge exploited for approximately $290–293 million (116,500 rsETH) via compromised RPC nodes and a single-point-of-failure DVN configuration. LayerZero and Chainalysis attribute the attack to Lazarus Group.
BleepingComputer / Chainalysis / CoinDesk21 April 2026
Researchers at Bitso's Quetzal Team and ANY.RUN (analyst: Mauro Eldritch) publicly disclose the Mach-O Man malware kit, publishing full technical analysis including binary names, IOCs, and four-stage attack chain.
ANY.RUN Cybersecurity Blog22 April 2026
CertiK publishes analysis linking Mach-O Man campaign to Lazarus Group and connecting it to the Drift and KelpDAO exploits. CoinDesk covers the story.
CoinDesk22 April 2026
Arbitrum reportedly freezes $71 million in funds linked to the KelpDAO exploit.
Bitcoin News5 May 2026
Drift Protocol publishes a recovery plan for affected users following the $285–295 million DPRK-linked exploit.
CoinDeskDecision Log
- slot 457988642 · hash 32CycwmvpsEi9sUTf1dkEzQRWQ7vQtB7SeJijve6kEu5
- slot 457977830 · hash CSYqLGxt2BiQVzx8E3FJmuChjPdqZu2H6SHarpM9UJzK
- slot 425410141 · hash DS1sJLqFWbL38d5dRSjEvPqf5nR6X9Y49VmPoaWKAfiJ
- slot 425410138 · hash 7i7298Mkk7o48yeGLugoQ9sV9kQ7hmUFbQ1bDC3DcLx3
- slot 424989785 · hash 69tyXeNe38meFGL6wsrEwJ192xUuw6qJH6VrVy51HaFW
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 21 of 21 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/7/2026, 11:05:18 PM
last updated: 6/7/2026, 11:05:18 PM
4 viewsavoid.net — verified advice for a post-truth world