Close Menu
  • Crypto News
  • Markets
  • Bitcoin
  • Ethereum
  • XRP
  • Altcoins
  • Technology
  • More
    • Crypto Prices – Latest from BTC, ETH & XRP
    • NFT
    • DeFi

Subscribe to Updates

Get the latest crypto news and updates directly to your inbox.

Trending

Tether Teams Up With Sustainability Giant Adecoagro on Renewable Bitcoin Mining Energy Project

July 3, 2025

RICH Miner simplifies cloud mining with real-time passive returns

July 3, 2025

Nano Labs doubles down on BNB with $50m OTC purchase

July 3, 2025

Senator Cynthia Lummis introduces crypto tax bill

July 3, 2025

Ripple’s RLUSD Stablecoin Lands First Bank Integration via AMINA

July 3, 2025
Facebook X (Twitter) Instagram
  • Advertise
en English
nl Nederlandsen Englishfr Françaisde Deutschit Italianoru Русскийes Españolzh-CN 简体中文hi हिन्दीja 日本語
Crypto Observer
  • Crypto News

    Ripple’s RLUSD Stablecoin Lands First Bank Integration via AMINA

    July 3, 2025

    Watch These 3 Ripple (XRP) Price Predictions in July

    July 3, 2025

    Dogecoin Could Detonate Shorty, Says Analyst—Here’s The Target

    July 3, 2025

    Why is the Pudgy Penguins (PENGU) Price up by 70% This Week?

    July 3, 2025

    PEPE Eyes 150% Jump To Grab Liquidity At $0.000025 After Bouncing Off ‘Powerful Support’

    July 3, 2025
  • Markets
  • Bitcoin
  • Ethereum
  • XRP
  • Altcoins
  • Technology
  • More
    • Crypto Prices – Latest from BTC, ETH & XRP
    • NFT
    • DeFi
Facebook X (Twitter) Instagram
Crypto Observer
Home » Bitcoin » North Korean hackers target macOS in latest malware campaign targeting crypto firms
Bitcoin

North Korean hackers target macOS in latest malware campaign targeting crypto firms

Crypto Observer StaffBy Crypto Observer StaffJuly 3, 2025No Comments3 Mins Read
Facebook Twitter Pinterest Reddit Telegram Email LinkedIn Tumblr
Share
Facebook Twitter LinkedIn Pinterest Email

North Korean cybercriminals have been targeting crypto firms using a new strain of malware that exploits Apple devices in a multi-stage attack.

Researchers at cybersecurity firm Sentinel Labs have issued a warning about the campaign, which leverages social engineering and advanced persistence techniques to compromise macOS systems.

The malware, dubbed “NimDoor,” is written in the lesser-known Nim programming language and is capable of evading traditional antivirus tools.

According to Sentinel Labs, the attackers initiate contact by impersonating trusted individuals on messaging platforms like Telegram. Victims, who in this case appear to be employees at blockchain or Web3 firms, are lured into fake Zoom meetings via phishing links and are instructed to install what appears to be a routine Zoom SDK update.

Once executed, the update script installs multiple stages of malware onto the victim’s Mac device. These include AppleScript-based beacons, Bash scripts for credential theft, and binaries compiled in Nim and C++ for persistence and remote command execution.

Binaries are standalone program files that carry out specific tasks within the malware chain. One binary, called CoreKitAgent, uses a signal-based persistence mechanism that runs when users try to close the malware, allowing it to stay active even after the system reboots.

Cryptocurrencies are a key target of the operation. The malware specifically seeks out browser-stored credentials and application data related to digital wallets.

The malware executes scripts designed to extract information from popular browsers like Chrome, Brave, Edge, and Firefox, as well as Apple’s Keychain password manager. Another component targets Telegram’s encrypted database and key files, potentially exposing wallet seed phrases and private keys exchanged over the messaging app.

North Korean hackers responsible

Sentinel Labs has attributed the campaign to a North Korea-aligned threat actor, continuing a pattern of crypto-focused cyberattacks by the Democratic People’s Republic of Korea. 

Hacking groups such as Lazarus have long targeted digital asset companies in efforts to bypass international sanctions and fund state operations. Previous operations have seen malware written in Go and Rust, but this campaign marks one of the first major deployments of Nim against macOS targets.

As previously reported by crypto.news, in late 2023, researchers observed another DPRK-linked campaign that deployed a Python-based malware known as Kandykorn. It was distributed through Discord servers disguised as a crypto arbitrage bot and primarily targeted blockchain engineers using macOS.

Sentinel Labs has warned that as threat actors increasingly adopt obscure programming languages and sophisticated techniques, traditional security assumptions around macOS are no longer valid.

Over the past months, several malware strains have targeted Apple users, including SparkKitty, which stole seed phrases via photo galleries on iOS, and a trojan that replaced wallet apps on macOS with a malicious version.

Read the full article here

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

Related Posts

Tether Teams Up With Sustainability Giant Adecoagro on Renewable Bitcoin Mining Energy Project

July 3, 2025

RICH Miner simplifies cloud mining with real-time passive returns

July 3, 2025

Hamak Limited transitions from gold mining business to Bitcoin corporate treasury

July 3, 2025

Trader Says the Time To Be Bullish on Altcoins Is Here, Updates Outlook on Bonk and One Other Solana-Based Memecoin

July 3, 2025
Add A Comment

Leave A Reply Cancel Reply

Subscribe to Updates

Get the latest crypto news and updates directly to your inbox.

Top Posts

Tether Teams Up With Sustainability Giant Adecoagro on Renewable Bitcoin Mining Energy Project

July 3, 2025

RICH Miner simplifies cloud mining with real-time passive returns

July 3, 2025

Nano Labs doubles down on BNB with $50m OTC purchase

July 3, 2025
Advertisement
Demo

Crypto Observer is your one-stop website for the latest crypto news and updates, follow us now to get the news that matters to you.

Facebook X (Twitter) Instagram
Crypto News

Watch These 3 Ripple (XRP) Price Predictions in July

July 3, 2025

Dogecoin Could Detonate Shorty, Says Analyst—Here’s The Target

July 3, 2025

Why is the Pudgy Penguins (PENGU) Price up by 70% This Week?

July 3, 2025
Get Informed

Subscribe to Updates

Get the latest crypto news and updates directly to your inbox.

Facebook X (Twitter)
  • Privacy Policy
  • Terms of use
  • Advertise with us | Publishing
  • Contact us
  • Crypto News – Press release
  • Newsletter sign up
  • Markets
  • Altcoins
  • Bitcoin
  • Crypto News
  • DeFi
  • Ethereum
  • Technology
  • Blockchain
  • AI
  • NFT
  • Thanks for joining us
© 2025 Crypto Observer. All Rights Reserved.

Type above and press Enter to search. Press Esc to cancel.