Live
Loading prices…
CoinHub Today · coinhubtoday.com
CoinHub Today · Security

‘Mach-O Man’: Lazarus’s New macOS Campaign Targets Crypto Executives

CertiK’s latest research describes a professionally operated macOS malware campaign aimed directly at the executive layer of crypto and fintech firms. The lure is business correspondence. The payload is an entrance ticket.

SecurityLazarus GroupmacOSCoinHub Today Research DeskApril 22, 20267 min read

CertiK published a detailed technical writeup of a macOS-focused attack campaign it calls “Mach-O Man” — a professionally operated set of malware loaders, signed binaries, and social-engineering lures aimed squarely at executives and senior engineers at crypto and fintech firms. Attribution, confirmed by Jamf Threat Labs, points to North Korea’s Lazarus Group.

40+
Confirmed incidents since late 2025
11 days
Median cert burn lifetime
12
Cases leading to nine-figure exploits
~23MB
Observed payload weight
ElementDetail
PlatformmacOS (signed Mach-O binary)
Primary lurePartnership / investor / media correspondence
DeliveryAttachment link or in-call file drop (Telegram, Slack, Zoom)
PersistenceLaunchAgent + keychain access hooks
ExfiltrationWallet app data, Keychain, iCloud Drive, dev credentials, SSH keys
AttributionLazarus Group (CertiK + Jamf Threat Labs confirmed)

What Makes This Campaign Different

The campaign is not technically exotic. What makes it notable is the discipline of the targeting and the polish of the social-engineering layer. Where Lazarus’s 2024 macOS efforts relied on recycled RustBucket and KANDYKORN variants, Mach-O Man features purpose-built tooling, rapid-rotation Apple Developer IDs, and lure content indistinguishable from routine business communication.

“The attackers have abandoned any pretense of scattershot phishing. Every observed lure in this campaign has been personalized. They know the person’s background, their recent conference appearances, their portfolio companies, and often the names of specific engineers they work with.”

— Ronghui Gu, Co-founder, CertiK

The Apple Developer ID Problem

Lazarus operators have been cycling through stolen or fraudulently obtained Apple Developer IDs to sign their binaries, defeating default Gatekeeper warnings. Jamf Threat Labs documented a median certificate-burn lifetime of roughly 11 days. The operators treat that lifespan as disposable inventory — rotating certificates faster than Apple can revoke them.

Once executed, the payload establishes a LaunchAgent for persistence, hooks macOS Keychain access, exfiltrates wallet-application storage, iCloud Drive artifacts, developer credentials and SSH keys, and opens a command-and-control channel used to pivot laterally. In at least 12 confirmed incidents, Mach-O Man access served as the initial foothold for follow-on nine-figure DeFi exploits.

Industrialization of the Playbook

What Mach-O Man adds to the picture is industrialization. The campaign infrastructure now supports dozens of parallel operator conversations. Lure templates are being customized at LLM-grade speed. Target lists are sourced from LinkedIn scraping, investor-database purchases, and conference-attendance lists. Infrastructure hosts have been linked by DNS analysis to the same command-and-control cluster that serviced the Bybit attackers.

The Harder Truth

Training-based defenses have diminishing returns at the executive layer. Senior engineers and founders are, by job description, approachable by strangers and paid to explore new partnerships. A trained executive may catch 60% of lures. The campaign is built to pump throughput until the remaining 40% converts. The recommended posture remains managed endpoints, hardware security modules for signing workflows, and elevated scrutiny of all inbound investor or partnership correspondence.

CISA Advisory — April 2026
CISA’s North Korea Cyber Threat advisory now explicitly warns crypto firms to assume their executives are being actively targeted and to treat all inbound investor or partnership correspondence with elevated scrutiny.
Sponsored · Web3Firewall
Pre-Signature Intelligence for Crypto Operations

The attacks described in this article exploit gaps that pre-signature transaction monitoring is built to close. Web3Firewall evaluates 100+ risk signals before a transaction reaches the blockchain — enforcing policy controls at the only moment intervention is actually possible.

Reporting note: Draws on CertiK, Jamf Threat Labs, and public disclosures. Editorial commentary; figures subject to revision as investigations continue.

Stay ahead with CoinHub Today

Real crypto news, market data, and analysis — free to your inbox every weekday at 7am.

No spam. Unsubscribe anytime. Sent to admin@coinhubtoday.com

CoinHub Today is an independent media organisation and does not provide investment, financial, or legal advice. All content is for educational purposes only. Cryptocurrency investments involve substantial risk. Past performance is not indicative of future results. Always consult a qualified financial adviser before investing.