First macOS Malware Dubbed ‘Applejeus’ Hits An Exchange In North Korea

The first macOS malware program seems to be live now – and coming directly from a team of North Korean hackers who infected a cryptocurrency exchange for both Windows and macOS users for the first time ever.

According to data from Kaspersky Lab that was published on August 23rd, the company revealed the malware – which is dubbed ‘Applejeus’ – to have made its debut into the systems of an unnamed exchange after one employee downloaded a “tainted” app. As Kaspersky Lab officially stated, the app probably came from a fake developer with fake security certificates in a major operation by a North Korean hacker collective named Lazarus Group.

The malware began stealing cryptocurrency funds, according to Kaspersky, in what marks the latest in a spate of both successful and failed attempts by North Korea in the crypto hacking space.

The report also states that in order to “ensure that the OS platform was not an obstacle to infecting targets, it seems the attackers went the extra mile and developed malware for other platforms, including for macOS.”

Before this, South Korean exchanges have been the main targets for Lazarus, after a rash of complaints by companies such as Bithumb, YouBit and Coinlink surfaced. As the head of Kaspersky’s GReAT APAC Team added:

“The fact that they developed malware to infect macOS users in addition to Windows users and – most likely – even created an entirely fake software company and software product in order to be able to deliver this malware undetected by security solutions, means that they see potentially big profits in the whole operation.”

Even though this is the first macOS attack targeting a crypto exchange, macOS malware attacks are not new to hackers. In early July, a team of security researchers discovered attacks that targeted Slack and Discord users who talked about cryptocurrencies – and hackers impersonating “key people” in crypto-related chats while sharing snippets that are downloaded and full of malicious binary codes.