Hackers Tricks macOS Users to Execute Command in Terminal to Deliver FlexibleFerret Malware

The report details FlexibleFerret, an ongoing 2025 campaign attributed to North Korean operators that lures macOS job seekers to realistic fake recruitment sites which instruct victims to run Terminal commands; these commands fetch a multi-stage payload (macpatch.sh) that installs persistence via LaunchAgents, presents fake Chrome prompts to harvest credentials (exfiltrated to Dropbox), and deploys a Golang backdoor with C2 functionality for data collection, file transfer, command execution, and profile theft.