North Korean Cyberattack Targets macOS with New Malware

According to ShibDaily, a new malware strain named NimDoor has been identified, targeting macOS devices. Developed by North Korean threat actors, this malware aims to steal cryptocurrency wallet credentials and Telegram data. Its use of the rare Nim programming language and delayed execution makes it difficult to detect, providing a strategic advantage over traditional malware. The cyberattack campaign, uncovered by researchers at cybersecurity firm SentinelLabs, involves advanced malware strains designed to infiltrate Apple devices. The malware bypasses Apple's built-in memory protections and delivers an infostealer payload specifically targeting data from crypto wallets. The threat actors employ a social engineering tactic by posing as a trusted contact on messaging platforms like Telegram. They engage the victim in conversation to establish credibility before inviting them to a fake Zoom meeting, disguised as a Google Meet session. A file mimicking a legitimate Zoom update is then sent, which serves as the delivery method for the malicious payloads. Once the fraudulent update file is executed, it installs the NimDoor malware onto the victim's device. The malware then harvests sensitive information, focusing on cryptocurrency wallets and stored browser credentials. Although the initial attack method follows a familiar pattern—leveraging social engineering, lure scripts, and fake software updates commonly associated with DPRK-linked campaigns—the use of the Nim programming language sets this malware apart. Nim-compiled binaries are rarely seen targeting macOS, making the malware less recognizable to conventional security tools and potentially more difficult to analyze and detect. The researchers noted that North Korean threat actors have previously experimented with programming languages like Go and Rust. However, the recent shift toward using Nim reflects a strategic advantage. Nim's cross-platform capabilities allow the same codebase to run on Windows, Linux, and macOS without modification, increasing the efficiency and reach of their attacks. The malicious payload includes a credential-stealing component engineered to discreetly harvest browser and system-level data, bundle the information, and transmit it to the attackers. Additionally, a script within the malware targets Telegram by extracting both its encrypted local database and the corresponding decryption keys. The malware employs a delayed activation mechanism, waiting ten minutes before executing its operations to evade security scanners.