North Korean Hackers Target macOS in Sophisticated Malware Campaign Against Crypto Firms

North Korean cybercriminals have escalated attacks on cryptocurrency firms with a new macOS malware strain, dubbed "NimDoor," designed to bypass traditional security measures. The campaign, identified by Sentinel Labs, employs social engineering tactics via platforms like Telegram, luring victims—primarily blockchain and Web3 employees—into fake Zoom meetings. Malicious scripts masquerading as Zoom SDK updates deploy multi-stage payloads, including credential-stealing Bash scripts and persistent Nim/C++ binaries.

The malware's architecture leverages AppleScript beacons and a resilient binary (CoreKitAgent) that reactivates after system reboots. Cryptocurrencies remain the primary focus, though the report does not specify affected assets or exchanges. This operation underscores the growing sophistication of state-sponsored threats targeting digital asset infrastructure.