I recently came across a breakdown of a macOS malware campaign that’s apparently linked to North Korea. What stood out was the use of a fake Realtek driver update to trick users into installing malware. The malware also includes anti-VM detection and other updates compared to previous campaigns.
It starts with pretty basic social engineering but gets sophisticated quickly — once installed, it can grab saved passwords, browser data, and more. It’s targeting macOS specifically, which is still a bit unusual compared to most malware campaigns.
Has anyone else seen this? Curious if anyone has encountered it in the wild or has thoughts on how Apple should handle these spoofed updates.
[link] [comments]