DPRK's "Contagious Interview" Campaign Moves Into macOS Malvertising to Drain Crypto Wallets

North Korea's long-running Contagious Interview campaign has stopped waiting for its targets to apply for a job. In a case documented by the security firm AllSecure and reported by The Hacker News on July 30, 2026, the same North Korea-linked operation now reaches macOS users through malvertising: a sponsored search result loads a web page that mimics a full-screen macOS update and ends, when it works, with a drained cryptocurrency wallet.

The malware and infrastructure are recognizable from earlier DPRK activity. What's new is the doorway. Earlier iterations of Contagious Interview leaned on fake recruiters, video assessments, and coding tests aimed at developers. This one starts with an ordinary web search — which means the assumption many crypto firms built their defenses around, that the danger shows up as a suspicious job offer, no longer describes the whole attack surface.

What Actually Changed

AllSecure attributes the campaign to the cluster tracked as UNC5342, the same grouping behind Contagious Interview, and The Hacker News frames it as a new iteration rather than a new actor. The delivery is the departure. In the observed case, a victim researching laboratory equipment clicked a sponsored result for a company that appeared to sell it, and the fake update sequence began as soon as the page loaded. AllSecure co-founder Christian Papathanasiou put the significance plainly to The Hacker News: the fake-job pattern isn't replaced, it's expanded — "the same operational logic appearing in a broader browsing scenario," he said, describing it as something that "expands the threat model."

Two technical choices make this harder to shut down than a routine stealer campaign. The page uses ClickFix-style social engineering to get the user to run attacker-supplied code themselves, sidestepping much of what a download-focused control would catch. And the resulting Node.js backdoor resolves its live command-and-control address from an Ethereum smart contract — a takedown-resistant technique known as EtherHiding that DPRK operators have used in prior Contagious Interview activity, per The Hacker News. Blocking a static list of domains doesn't neutralize a C2 pointer that lives on a blockchain.

The payloads are squarely financial. AllSecure reports an information stealer that harvests browser data across Chrome, Brave, Edge, Firefox, Opera, and Vivaldi, along with SSH, AWS, Azure, and npm credentials, and that specifically targets 157 cryptocurrency wallets. A second payload — a malicious browser extension presenting itself as "Google Drive Offline" — is used to drain wallets directly. AllSecure traced both back to a single wallet cluster, which it reads as the work of one operator that has industrialized its deployment.

Campaign lineage: Contagious Interview

• Fake job interviews and coding tests — the campaign's original developer-targeting lure and its most-reported form.
• SVG steganography, OtterCookie-aligned payloads — a mid-2026 iteration that CyberSignal covered, hiding malware fragments inside ordinary-looking image assets.
• EtherHiding blockchain C2 — DPRK operators moving live command-and-control pointers onto Ethereum smart contracts to resist takedown, per The Hacker News.
• macOS malvertising and a fake full-screen update (new here) — delivery through a sponsored search result to macOS crypto users, ending in a wallet-drainer, per AllSecure.

Sourced to AllSecure and The Hacker News (July 30, 2026) and prior CyberSignal reporting. The sequence traces the evolution of lures and infrastructure over time, not the fixed order of a single intrusion. Overlap with specific named tooling from earlier iterations (such as the BeaverTail and InvisibleFerret families) is not confirmed for this campaign and is not asserted here.

Why This Reaches Beyond Developers

The reason to treat this as more than another stealer write-up is the population it can now touch. A fake-recruiter lure self-selects for job-seeking developers. A poisoned search result self-selects for anyone — including the treasury, finance, and executive staff at crypto and Web3 firms who hold wallets but were never in the "watch out for fake interviews" briefing. The operation's economics also improve: qualifying and reaching victims through paid search is cheaper and quieter than running a convincing months-long recruitment con, and it scales to whatever the operator is willing to pay for placement.

This also rhymes with a pattern CyberSignal has tracked in the same ecosystem — North Korea-linked groups reworking the pretext while keeping the objective fixed. The through-line across the interview lures, the Zoom-themed kits, and now the fake update is a plausible professional or everyday context wrapped around the same goal: get to people who touch cryptocurrency.

What Mac Users and Crypto Defenders Should Check

The single most useful heuristic here is also the simplest: a real macOS update never takes over your whole screen from a web page, and it never asks you to open Terminal and paste in a command. Legitimate updates live in System Settings > General > Software Update. If a browser tab is the thing "updating" or "rebooting" your Mac, it is hostile — close the tab and walk away. That one rule defeats the entire lure regardless of how convincing the animation looks.

Beyond that, a short list of concrete checks, with confidence noted:

• Never run a command a web page hands you. Copy-and-paste-into-Terminal is the reported core of this technique; treat any such instruction as an attack, not a fix. (Confidence: reported as the central method.)
• Review login items and LaunchAgents. The reported backdoor uses a LaunchAgent for persistence, so unexpected entries in ~/Library/LaunchAgents or your login items are worth inspecting on any Mac where a fake update was interacted with. (Confidence: mechanism reported.)
• Audit browser extensions. A "Google Drive Offline" extension you did not install is a specific reported indicator of the wallet-drainer; check across all Chromium-based browsers, not just your primary one. (Confidence: named by AllSecure.)
• Add the reported infrastructure to watchlists, but don't stop there. AllSecure named two C2-pointer domains — rg-telemetry[.]sbs and th-updates[.]sbs — worth folding into detection and retro-hunts. Because the live C2 is resolved via EtherHiding, domain-blocking alone is incomplete; hunt for the LaunchAgent persistence and the periodic outbound check-ins as well. (Confidence: indicators reported; the EtherHiding limitation is our assessment.)
• Widen the awareness net past developers. For crypto and Web3 organizations, the people who most need this heuristic are wallet-holding staff in treasury, engineering, and leadership — precisely the group a fake-interview briefing tends to skip.

What's Still Unconfirmed

Several specifics are not established in public reporting, and CyberSignal is not filling them in. No reputable source has assigned this a distinct malware-family name; it is reported as an iteration of Contagious Interview (UNC5342), not as a newly christened toolset. The ad networks used to place the malicious search result, the scope of victims and affected macOS versions, and the particular crypto applications targeted beyond the 157-wallet figure are not detailed. There is no reported Apple response — an XProtect signature, a notarization revocation, or an advisory — tied to this campaign as of writing, and any operational overlap with the BeaverTail or InvisibleFerret tooling seen in earlier Contagious Interview activity is unconfirmed for this specific case. Each of those is an open question, not a claim.

Primary Documents

• AllSecure — "ClickFix, EtherHiding & a DPRK Wallet Trail" (primary research)
• The Hacker News — "DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware" (reporting)