Remember those nice North Korean hackers who destroyed Sony Pictures' computers, spread the WannaCry ransomware worm around the world and stole $100 million (opens in new tab) from the central bank of Bangladesh? Well, they're back, and they're attacking Macs.
Malwarebytes (opens in new tab) researchers said today (May 6) that the Lazarus Group, also known as Hidden Cobra, has repurposed the Linux variant of the Dacls remote-access Trojan (RAT) to work on Macs. RATs sneak onto a machine and give a remote attacker partial or full control.
- The best Mac antivirus software to keep your Apple polished
- Best password managers to secure your online accounts
- Just In: iPhone 12 design just leaked - here's your first look
"This Mac version is at least distributed via a Trojanized two-factor authentication application for macOS called MinaOTP, mostly used by Chinese speakers," a Malwarebytes blog post explained. "It boasts a variety of features including command execution, file management, traffic proxying and worm scanning."
We'd normally tell you that you don't have much to fear from state-sponsored hackers. American, Chinese and Russian cyberespionage crews normally just want information and focus on diplomats, military officials, defense contractors, politicians and the like.
But North Korea's hackers have no problem committing regular crimes to make money. So this new Mac malware could just be limited to targeting specific individuals in China -- or it could be the beginning of a sustained mass spying campaign. (The Lazarus Group has been stealing cryptocurrency from Mac users for nearly two years.)
Either way, your best bet on how to avoid this Mac RAT is to install and run some of the best Mac antivirus software. Microsoft, Kaspersky, Trend Micro and of course Malwarebytes already recognize this RAT's signature; others will soon add it to their malware-definitions updates.
- Get maximum protection with the best Mac VPN
