North Korea macOS malware ClickFix cryptocurrency theft EtherHiding

North Korea's Contagious Interview Campaign Goes Full ClickFix With Blockchain C2

31 July 2026

North Korea-linked threat actors have launched a sophisticated macOS malvertising campaign, dubbed a new iteration of "Contagious Interview," that redirects users to fake websites displaying a convincing full-screen fake software update to trick them into running malicious Terminal commands via the ClickFix technique. The malware uses "EtherHiding" — embedding C2 server addresses in Ethereum smart contracts — to resist takedowns, ultimately delivering an information stealer targeting 157 cryptocurrency wallets and a malicious Chrome extension designed to drain victims' funds. Notably, this campaign departs from the group's typical fake job interview lures, instead targeting ordinary web searches, suggesting North Korean operators are broadening their attack vectors beyond developer recruitment scenarios.

A North Korea-linked threat cluster has been caught running a slick macOS malvertising operation that drops crypto-stealing malware via fake system update screens and a pinch of social engineering. Researchers at AllSecure attribute the activity to the Contagious Interview group, also tracked as UNC5342, and the campaign introduces a few wrinkles that are worth paying attention to.

The attack starts somewhere most people would consider completely unremarkable: a Google search. In the case AllSecure documented, the victim was looking up electrophoresis machines and clicked a sponsored result that appeared to be a legitimate supplier. That click kicked off the whole infection chain. No dodgy job offer, no suspicious recruiter on LinkedIn, no coding test that somehow requires you to install a custom npm package. Just a search result.

Once the fake site loads, the browser goes full-screen and displays what looks exactly like a macOS system update or reboot sequence. The machine appears frozen or mid-restart. Panic-inducing by design. While the victim is busy wondering if their laptop has died, the page has already silently copied a command into their clipboard.

The fake update eventually 'completes' and the page instructs the user to open Terminal and paste the copied command. That command is a curl request that fetches a Node.js backdoor. The backdoor installs a LaunchAgent for persistence and then does something clever for resilience: instead of connecting directly to a hardcoded C2 server, it queries an Ethereum smart contract to retrieve the actual server address. This technique is called EtherHiding, and it makes traditional takedown efforts considerably more annoying. You can't just report a dodgy IP address and call it a day.

The backdoor checks in with its C2 every five minutes and executes whatever JavaScript gets sent back. What gets sent back is unpleasant. Two payloads are delivered through this mechanism: an information stealer that goes after credentials stored in Chrome, Brave, Edge, Firefox, Opera, and Vivaldi, plus SSH keys, AWS credentials, Azure tokens, npm keys, and data from 157 separate cryptocurrency wallets. The second payload is a malicious Chrome extension masquerading as 'Google Drive Offline', which gets sideloaded by patching Chrome's Secure Preferences file and is used to drain crypto wallets directly.

Two Ethereum addresses are baked into the malware, each pointing to throwaway smart contracts. AllSecure's analysis of the deployment pattern is telling: each contract was created by a wallet that received a small ETH funding, deployed the contract, wrote the configuration, forwarded the leftover funds, and was then abandoned. It's a production pipeline. Fund, deploy, configure, drain, abandon, repeat.

Both the backdoor and the extension drainer trace back to the same wallet cluster, which suggests a single operator rather than loosely affiliated actors sharing tooling.

There's also a broader point worth flagging. Contagious Interview is usually discussed in the context of fake job interviews and developer recruitment scams. That framing is accurate but increasingly incomplete. As AllSecure's CEO Christian Papathanasiou notes, this campaign applies the same operational logic to general browsing. The fake-job pattern hasn't gone away. The attack surface has just grown.

READ NEXT

TELEPUZ: The Modular Malware Using Telegram, Steam, and a Blockchain to Phone Home ACR Stealer Is Raiding Enterprise Networks and All It Needs Is for Someone to Press Enter Roundup: Iranian Spooks Track US Troops Via Ad Data, macOS Malware Plays Dead, and a Textile Firm Goes Bust After Six Weeks of Ransomware Hell