Key Takeaways
- North Korean threat actors have revived the Contagious Interview (UNC5342) campaign with a macOS‑focused malvertising chain that begins with a benign web search rather than a fake job interview.
- The attack displays a convincing full‑screen macOS update screen, uses the ClickFix technique to copy a malicious command to the clipboard, and then prompts the victim to paste it into Terminal.
- Command‑and‑control infrastructure is hidden in Ethereum smart contracts (EtherHiding), making takedown resilient; two contracts resolve to the domains rg‑telemetry[.]sbs/api and th‑updates[.]sbs/analytics.
- The delivered payload includes a Node.js backdoor for persistence, an information stealer targeting 157 cryptocurrency wallets and various credential stores, and a malicious Chrome extension (“Google Drive Offline”) that drains wallets.
- Both the backdoor and the extension are funded from the same wallet cluster, indicating a single, industrialised actor that repeatedly funds, deploys, configures, drains, and abandons throwaway wallets.
- The campaign expands the threat model for DPRK‑linked operations, showing that the same social‑engineering logic can be applied to generic browsing scenarios.
Overview of the Campaign
In July 2026, security researchers at AllSecure uncovered a new iteration of the long‑running Contagious Interview operation, previously attributed to North Korean state‑linked actors. Unlike earlier waves that lured victims with bogus job offers, coding tests, or video assessments, this version begins when a user performs an innocuous web search—such as looking for electrophoresis machines—and clicks a sponsored result that leads to a malicious landing page. The page instantly loads a full‑screen imitation of a macOS software‑update sequence, creating the impression that the operating system is frozen or rebooting. This visual ruse is designed to induce panic, prompting the victim to follow instructions they would normally regard as suspicious.
The ClickFix Social‑Engineering Technique
Central to the deception is the ClickFix method, a known tactic that leverages the macOS clipboard to execute attacker‑supplied commands. While the fake update animation runs, a command is silently copied to the user’s clipboard. Once the animation concludes, the page displays a prompt instructing the victim to open the Terminal application and paste the copied command. Because the command is already on the clipboard, the victim only needs to hit Enter, believing they are completing a legitimate system‑recovery step. Notably, attempts to replay the same sequence fail to produce the identical clipboard content, indicating that the attack is engineered for a single‑use execution per visitor.
Infection Flow After Terminal Execution
The pasted command is a curl request that downloads a Node.js‑based backdoor. This backdoor installs a LaunchAgent to achieve persistence, ensuring it runs each time the user logs in. It then contacts an Ethereum smart contract to resolve the actual command‑and‑control (C2) server address—a technique dubbed EtherHiding. The implant checks in with the resolved C2 endpoint every five minutes, awaiting JavaScript instructions that can be executed in the victim’s context. This polling mechanism allows the attackers to dynamically update payloads or issue new commands without redeploying the initial binary.
EtherHiding: Blockchain‑Based C2 Resilience
EtherHiding stores the C2 infrastructure inside immutable Ethereum smart contracts, rendering traditional takedowns ineffective. Two contracts, funded by throwaway wallets, contain the configuration strings “rg‑telemetry[.]sbs/api” and “th‑updates[.]sbs/analytics.” Each contract follows a repeatable four‑step lifecycle: the wallet is funded with roughly 0.0126 ETH, the contract is deployed, the configuration is written, the remaining ~0.006 ETH is forwarded to another address, and the wallet is then abandoned. This pattern suggests an industrialised operation where actors mass‑produce, configure, and discard wallets to evade attribution and financial tracing.
Payloads Delivered via EtherHiding
Once the backdoor establishes contact, it retrieves two distinct malicious payloads from the C2 server:
-
Information Stealer – A modular harvester that exfiltrates data from popular browsers (Chrome, Brave, Edge, Firefox, Opera, Vivaldi), credentials stored in SSH, AWS, Azure, and npm environments, and private keys from 157 cryptocurrency wallets. The stealer enumerates installed extensions, extracts saved passwords, and collects wallet files, uploading them to the attacker‑controlled server.
- Malicious Chrome Extension (“Google Drive Offline”) – This extension is sideloaded by patching Chrome’s Secure Preferences file, thereby bypassing the Web Store’s review process. Once active, it masquerades as a legitimate offline‑access tool while surreptitiously draining the victim’s cryptocurrency wallets through unauthorized transactions. The extension can also inject additional scripts into web pages to capture session tokens or manipulate wallet interfaces.
Both payloads are signed and delivered from the same Ethereum‑funded wallet cluster, reinforcing the assessment that a single threat actor orchestrates the entire operation.
Why This Variant Differs from Prior Contagious Interview Waves
Previous Contagious Interview campaigns relied heavily on social engineering lures that mimicked recruitment processes—fake job listings, technical assessments, or interview invitations. The current campaign’s entry point is a generic search result, demonstrating that the attackers have abstracted their core tactic (inducing a false system‑failure state to trigger a privileged command) from the specific lure. This shift broadens the attack surface: any user who trusts a sponsored link or search result can be victimised, regardless of whether they are seeking employment or technical resources. As Christian Papathanasiou, co‑founder and CEO of AllSecure, notes, the fake‑job pattern is not replaced; rather, it is expanded to encompass broader browsing behaviours.
Attribution and Operational Insights
AllSecure’s analysis ties the activity to North Korean threat actors, citing similarities in the use of EtherHiding, the specific command structure, and the reuse of infrastructure observed in earlier UNC5342 operations. The uniformity of the wallet‑fund‑deploy‑configure‑drain‑abandon cycle across both the backdoor and the extension strongly indicates a single, well‑resourced operator capable of scaling the campaign. The use of a modest amount of Ether per deployment (~0.0126 ETH) suggests a cost‑effective strategy that maximises impact while minimising traceable financial footprints.
Defensive Recommendations
Organisations and individual users should adopt several mitigations to counter this threat:
- User Education: Emphasise that legitimate macOS updates never require manual Terminal commands; any prompt to paste clipboard contents into Terminal should be treated as highly suspicious.
- Clipboard Monitoring: Deploy endpoint solutions that alert when a command is copied to the clipboard from a web page and subsequently executed in a privileged shell.
- Browser Hardening: Disable automatic execution of extensions from unknown sources, enforce strict extension‑installation policies, and regularly audit the Secure Preferences file for unauthorised modifications.
- Network Controls: Block outbound connections to known Ethereum‑resolved domains (e.g., rg‑telemetry[.]sbs, th‑updates[.]sbs) unless explicitly required for legitimate blockchain interactions.
- Threat‑Intelligence Feeds: Subscribe to feeds that flag newly created Ethereum contracts with the characteristic fund‑deploy‑configure‑drain pattern, enabling proactive blocking of associated C2 infrastructure.
By combining vigilant user behaviour with technical controls that detect clipboard‑based command abuse and anomalous blockchain‑linked communications, defenders can reduce the likelihood of successful infection from this evolving macOS‑targeted malvertising campaign.