Lazarus Targets macOS Users With New “Mach-O Man” Malware Kit

Lazarus Group is conducting a ClickFix social engineering campaign targeting fintech and crypto organizations by convincing macOS users to paste Terminal commands that deploy a modular Mach-O malware kit. The chain (stagers such as teamsSDK.bin, profilers like D1YrHRTg.bin, and a stealer macrasv2) harvests browser credentials, cookies, and Keychain entries, establishes persistence via LaunchAgents (e.g., minst2.bin disguised as OneDrive/Antivirus Service), and exfiltrates data to C2 — evading many EDRs by abusing native utilities and user-driven execution.