“Can You Hear Me?” BlueNoroff Hackers Use Fake Audio Glitch to Breach macOS

Daylight Security reports a BlueNoroff (Lazarus subgroup) campaign that lures cryptocurrency and financial professionals from messaging apps into Microsoft Teams calls, where attackers feign audio issues to coerce victims into pasting terminal commands. The commands download a macOS executable placed at /Library/Caches/com.apple.sys.receipt which the actor makes executable and ad-hoc signs; the observed payload performs credential theft by copying the user Keychain and employs additional hidden components for persistence.