Skip to content

Lazarus hackers target macOS users luring them with crypto dream job offers

Lazarus hackers target macOS users luring them with crypto dream job offers

The infamous North Korean hackers known as the ‘Lazarus Group’ are at it again; this time targeting unsuspecting Apple macOS users hoping to land a dream job in the cryptocurrency industry.

Specifically, in what is the latest variant of a hacking campaign dubbed ‘Operation In(ter)ception,’ the hackers have been luring macOS users with enticing job offers at crypto exchange, the cybersecurity company SentinelOne said on September 26.

How the attacks were carried out

In the orchestrated attack, the hackers have disguised malware as job postings from the popular crypto exchanges, using well-designed and legit-looking decoy PDF documents advertising vacancies for positions such as Art Director – Concept Art (NFT) in Singapore.

Detailing the hacker campaign, SentinelOne said that:

“Although it is not clear at this stage how the malware is being distributed, earlier reports suggested that threat actors were attracting victims via targeted messaging on LinkedIn.”

According to the company’s report, the group has done the same thing back in August 2022, but this time using the fake job postings at the Coinbase crypto exchange, as spotted by researchers at another cybersecurity firm – ESET

Malicious history of the Lazarus Group

Since 2020, the Lazarus Group has been connected with a number of enticing job offerings used to lure in their victims, including in aerospace and defense industries, in a campaign referred to as ‘Operation Dream Job’ where the primary targets were Windows users.

The group has also been involved in multiple thefts in the crypto industry, including the attack on Harmony network’s Horizon bridge in June, which forced the blockchain company to mint over 2 billion ONE tokens in an effort to compensate about 65,000 victims of the $100 million hack.

Meanwhile, the mixing service Tornado Cash has been implicated in the scandal in which the United States Treasury Department alleged that it was used by multiple hacker groups, including the Lazarus Group, to launder stolen assets, as Finbold reported.

Best Crypto Exchange for Intermediate Traders and Investors

  • Invest in 70+ cryptocurrencies and 3,000+ other assets including stocks and precious metals.

  • 0% commission on stocks - buy in bulk or just a fraction from as little as $10. Other fees apply. For more information, visit

  • Copy top-performing traders in real time, automatically.

  • eToro USA is registered with FINRA for securities trading.

30+ million Users
eToro is a multi-asset investment platform. The value of your investments may go up or down. Your capital is at risk. eToro USA LLC does not offer CFDs, only real Crypto assets available. Don’t invest unless you’re prepared to lose all the money you invest.

Read Next:

Weekly Finance Digest

By subscribing you agree with Finbold T&C’s & Privacy Policy

Related posts