Ferret Malware Added to 'Contagious Interview' Campaign

Apple distributed XProtect signature updates to block variants of the macOS "Ferret" malware family tied to a DPRK campaign called “Contagious Interview,” in which targets are tricked into installing malicious software via fake job-interview links. The campaign drops JavaScript (BeaverTail) and a Python backdoor (InvisibleFerret) that harvests browser and crypto wallet data; researchers have observed evolving variants (including FlexibleFerret) that have at times evaded detection.