Lazarus Hackers Attacking macOS Users With ‘Mach-O Man’ Malware Kit

Mach-O Man is a Go-compiled, native Mach-O macOS malware kit attributed to Lazarus (Chollima) that targets fintech, crypto developers, and high-value enterprise users via Telegram "ClickFix" lures directing victims to fake conferencing sites and convincing them to run a terminal command. The kit unfolds in four stages—teamsSDK.bin (stager), profiler (system inventory and C2 registration), minst2.bin (persistence via a fake OneDrive LaunchAgent), and macrasv2 (stealer that exfiltrates browser data and macOS Keychain via Telegram)—and contains identifiable IOCs (domains, filenames, Telegram bot token) and operator OPSEC errors that aid detection and takedown.