impersonates Coinbase to scam Web3 job seekers on macOS

Lazarus Group

Lined Circle
Lined Circle

Lazarus Group, a North Korean hacker group recently sanctioned by the US, is attacking IT job seekers on macOS devices. The group impersonates Coinbase to scam people for infotheft and malware.

Web3 developers, creators, and builders who use macOS are under threat. Lazarus has been successful in finding a loophole to steal info from Apple devices after scamming people on Microsoft windows.

Usually, macOS is considered to be the safest operating system for Web3 developers but researchers have found that hackers are targeting macOS users by sending fake pdf files that contain malware.

The researchers claim Lazarus is pretending to be Coinbase, the largest exchange, on LinkedIn and other sites. They send fake interview questions and then send a .pdf file about the job details.

As soon as the user downloaded the file named Coinbase_online_careers_2022_07 containing a malicious DLL.  The malware is made with high tech that can attack devices with Intel or Apple processors.

Researchers have shared three files names that Lazarus has sent to infect endpoint as of now:

FinderFontsUpdater.app the downloader “safarifontagent” Coinbase_online_careers_2022_07.pdf

-

-

-

The researchers also shared that Apple failed to scan malicious content hidden inside the file, which means the hacker group seems to have found a loophole and is using it for its advantage.

IT and Web3 developers are advised to remain on guard in case a fake account disguised as Coinbase tries to contact them via job-seeking sites. Always check file sources before downloading them.