FlexibleFerret malware continues to strike

Jamf Threat Labs details an active FlexibleFerret macOS campaign that uses fake recruitment assessments and Terminal-based social engineering to install a multi-stage loader (JavaScript stagers → macpatch.sh → drivfixer.sh → Go backdoor). The malware establishes persistence via a LaunchAgent, exfiltrates captured credentials to Dropbox, contacts a hard-coded C2 (95.169.180.140:8080), and the report provides file hashes, domains, URLs, and file paths as IoCs for detection and response.