The North Korean Lazarus Group uses macOS malware toolkit to attack cryptocurrency and fintech companies
Prefer us on Google
According to CoinDesk, monitoring by CertiK reveals that the Lazarus Group is conducting an attack operation named Mach-O Man targeting executives in the fintech and cryptocurrency industries. This operation utilizes ClickFix social engineering techniques, sending fake online meeting invitations to lure victims into pasting repair commands on their Mac terminals, thereby gaining access to company and financial systems.
CertiK researcher Natalie Newson stated that the Lazarus Group has stolen over $500 million through attacks on Drift and KelpDAO in the past two weeks. Mach-O Man is a modular macOS malware toolkit developed by the Chollima division of the Lazarus Group, capable of automatically deleting itself after use to evade detection.
Additionally, attackers have implemented this attack by hijacking DeFi project domain names and replacing them with fake Cloudflare messages.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
The Shift in Financial Competition through On-Chain Technology: Insights from Simplex's Miura on Future and Social Implementation Strategies
North Korea's IT Deception in Remote Hiring: A Security Test for Cryptocurrency Recruitment
North Korean Infiltration Detected in 1,640 Companies to Steal Cryptocurrencies
Why AI is now a more immediate threat to Bitcoin than quantum computers
Tornado Cash Sees 968 Deposits on July 23, 2026
94% of Cryptocurrency Hacks in the First Half of the Year Occurred Outside Audit Scope
Lazarus Moves 121.5 BTC: The North Korean Laundering Machine is Still Running
Crypto Hacks Reach 212 Incidents, Over 1.1 Billion USD Stolen in H1 2026
Bernstein cuts Circle price target to $140, says Open USD threat will fade
North Korean Hacking: 1.6 Trillion Won in Virtual Assets Stolen in the First Half of the Year
Bitcoin Price Prediction: What's Next for BTC After the Fed Meeting?
Bitcoin trades near $63,000 ahead of the July 28–29 Fed meeting. See how the decision, ETF flows, and market sentiment could shape BTC’s next major move.
Cryptocurrency Industry Loses Over $1 Billion in First Half of 2026, Ethereum and Solana Suffer the Most
Velocity Private Test Version Continues to Run, Audit and Risk Reinforcement Underway
CertiK: In the first half of 2026, Web3 losses exceeded $1.3 billion, with attacks accelerating towards high-value targets
Drift announced its rebranding to Velocity and a relaunch, positioning itself as a new generation perpetual contract trading platform
Data: In 2026, the total locked value in DeFi decreased by 39%, while TRON and Hyperliquid grew against the trend
The G7 calls for a united effort to combat North Korea's cryptocurrency theft and cybercrime
Pyra announces the cessation of operations and the initiation of an orderly liquidation
Stablecoins vs Deposit Tokens: On the surface, they seem like opposing sides, but in reality, they are interconnected
CertiK: In May, the cryptocurrency market suffered losses of $68.3 million due to theft, a decrease of nearly 90% compared to the previous month
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
Drift Protocol Hack: Understanding One of the Largest Solana Ecosystem Breaches
Key Takeaways Drift Protocol, a decentralized exchange on Solana, experienced a $270 million hack, making it one of…
Navigating the Drift Protocol Security Incident: What You Need to Know
Key Takeaways On April 2, Drift Protocol experienced a security breach where a malicious actor gained administrative control.…
Wormhole’s Response to Drift Protocol Incident: Delays in Cross-Chain Transfers
Key Takeaways Wormhole confirmed that user assets remain safe despite the Drift Protocol attack. The Solana ecosystem’s built-in…
Wave of Cyber Attacks Hits DeFi Protocols Post-Drift Hack
Key Takeaways A significant $280 million attack on Drift Protocol set off a chain of security breaches across…
North Korea’s $500M DeFi Heist Unveils New Cyber Warfare Tactics
Key Takeaways: North Korean operatives have obtained over $500 million from DeFi platforms in under three weeks. The…
Volo Protocol Suspends Vaults Following $3.5 Million Exploit
Key Takeaways: Volo Protocol was exploited for $3.5 million from its WBTC, XAUm, and USDC vaults. The platform…
Drift Protocol: The insurance fund was not affected by the attack, and users can withdraw their staked shares after recovery
The tokenized market will reach a trillion-dollar scale, but there are still four major obstacles
Drift announces a user recovery plan for the $295 million North Korean hacker attack
The Shift in Financial Competition through On-Chain Technology: Insights from Simplex's Miura on Future and Social Implementation Strategies
North Korea's IT Deception in Remote Hiring: A Security Test for Cryptocurrency Recruitment
North Korean Infiltration Detected in 1,640 Companies to Steal Cryptocurrencies
Why AI is now a more immediate threat to Bitcoin than quantum computers
Tornado Cash Sees 968 Deposits on July 23, 2026
94% of Cryptocurrency Hacks in the First Half of the Year Occurred Outside Audit Scope
Contents
Latest articles
Latest coin listings on WEEX
