North Korean Hackers Update BeaverTail Malware to Target MacOS Users

Cybersecurity researchers have identified a DPRK-linked campaign delivering an updated BeaverTail JavaScript stealer via a malicious MiroTalk installer (macOS DMG and Windows MSI) and weaponized npm packages; the malware exfiltrates browser data, crypto wallets and iCloud Keychain, can fetch additional payloads (InvisibleFerret Python backdoor and AnyDesk for persistence), and mirrors legitimate software to socially engineer job-seeking developers into installing the trojanized applications.