Skip to main content
AVOID.NET
Sign in

Lazarus Group Mach-O Man macOS Campaign — 2026

avoid.net/lazarus-group-mach-o-man-macos-campaign-2026→0/100·92% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2C5bUa…W87A

Summary

The Lazarus Group Mach-O Man campaign is a state-sponsored macOS malware operation publicly disclosed in April 2026, attributed to North Korea's Reconnaissance General Bureau via the Chollima operational unit. The campaign delivers a modular, Go-compiled malware kit through ClickFix social engineering — fake video-conference invitations distributed over Telegram — targeting cryptocurrency developers, fintech executives, and high-value enterprise users running Apple hardware. Researchers at Bitso's Quetzal Team and the ANY.RUN sandbox platform identified four distinct attack stages culminating in macOS Keychain theft, browser credential harvesting, and exfiltration via the Telegram Bot API.

Connected Entities

10 entities · 60 linked investigations
Organizations
□TraderTraitor / UNC48990□Drift52□Mach-O Man Malware Campaign (Lazarus / Chollima)0□KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus0□Ronin Network22□Citrine Sleet / AppleJeus0□Lazarus Group Mach-O Man macOS Campaign — 2026
Protocols
⌂Drift Protocol18⌂LayerZero — DVN Single-Verifier Configuration Risk
Tokens
♦Bitcoin62
Relationships
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Bitcoin(80%)
  • TraderTraitor / UNC4899→mentioned with→Drift(85%)
  • TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
  • KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus→mentioned with→Drift(85%)
  • Mach-O Man Malware Campaign (Lazarus / Chollima)→mentioned with→Drift(85%)
  • Lazarus Group Mach-O Man macOS Campaign — 2026→mentioned with→Drift(85%)
  • Lazarus Group Mach-O Man macOS Campaign — 2026→mentioned with→Bitcoin(60%)
  • LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→Bitcoin(65%)
  • LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→TraderTraitor / UNC4899(75%)
  • Drift Protocol→mentioned with→KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus(75%)
  • + 24 more
Also appears in
Drift Protocol·52Citrine Sleet / AppleJeus·0Ronin Network·22Bitcoin·62Lendf.me·30OpenZeppelin AI Exploit Threat Vector·15Shibarium·28Ruslan Igorevich Tkachuk·2SafePal·42Bitcoin Xchange (Syria-based, ISIS-Linked)·0+ 50 more

Connected Through

9 shared actors · 576 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Lazarus Group Mach-O Man macOS Campaign — 2026?

Timeline(7 events)

14 April 2022

OFAC places Lazarus Group on the Specially Designated Nationals (SDN) list under North Korea Sanctions Regulations section 510.214.

US Treasury OFAC

April 2026

Drift Protocol suffers an alleged $285 million exploit attributed to the Lazarus Group's TraderTraitor sub-unit, occurring in the same operational window as the Mach-O Man campaign.

SpotedCrypto / Wasteland Intel

18 April 2026

KelpDAO suffers a $290–$292 million bridge exploit attributed to Lazarus Group / TraderTraitor by LayerZero and Chainalysis. The attack targeted off-chain RPC infrastructure rather than smart contracts.

Bleeping Computer / Chainalysis

21 April 2026

Bitso Quetzal Team researcher Mauro Eldritch, collaborating with ANY.RUN sandbox, publicly discloses the Mach-O Man macOS malware kit and the broader 'North Korea's Safari' campaign cluster.

ANY.RUN Blog

22 April 2026

CertiK analyst Natalie Newson and CoinDesk publish findings connecting the Mach-O Man kit to the Chollima unit of Lazarus Group. CertiK states that over $500 million was siphoned by Lazarus across Drift and KelpDAO in the preceding two weeks.

CoinDesk

22 April 2026

Multiple security outlets — CyberSecurityNews, GBHackers, Dark Reading, Cryptopolitan, Bitcoin News, and BanklessTimes — independently publish coverage of the Mach-O Man campaign with technical indicators.

CyberSecurityNews / Dark Reading

9 June 2026

Group-IB Threat Intelligence reports ClickLock Stealer, a related modular macOS stealer distributed via ClickFix phishing pages, targeting 100+ victims across 33 countries — indicating diffusion of Mach-O Man-style techniques into broader criminal activity.

RH-ISAC
Provenance & Audit Trail
Anchored on SolanaVerify on-chain22 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 22 of 22 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 8/7/2026, 12:26:01 PM

last updated: 9/20/2026, 6:41:48 PM

5 views

avoid.net — verified advice for a post-truth world