Fake LinkedIn jobs trick Mac users into downloading Flexible Ferret malware

Researchers identified the 'Contagious Interview' social-engineering campaign that lures job applicants to a fake recruitment site, prompts them to execute a malicious update (disguised as FFmpeg) via a curl command, and installs FlexibleFerret — a Go-based macOS backdoor that captures passwords, persists via LaunchAgent, exfiltrates browser/profile data and files, and enables remote command execution; attribution in the report points to DPRK actors and Windows targets face a related stealer (InvisibleFerret).