Hook, Line & Koi Stealer: New macOS Malware in DPRK Fake Job Interviews

The talk begins with how an alert on a suspicious connection led the investigators to a fake Visual Studio update domain. Tracing the chain revealed a booby-trapped software project that, once built, contacted attacker infrastructure and downloaded further malware. The presenters place this in a wider pattern: North Korean operators pose as tech recruiters and send developers, especially those in cryptocurrency, a take-home coding assignment. An earlier public report and an FBI warning matched the activity.

The core of the talk is the macOS sample. It shows a password prompt that reappears until the user complies, string obfuscation reversed with a simple XOR routine, and a stealer that collects files and wallet data into memory, encrypts them and sends them to the server. A notable trick is that the malware asks Finder, through AppleScript, to read Desktop and Documents, which avoids direct privacy prompts and may get a user to approve a vaguer request. It also mutes system sound during copying. The malware was tied to the Windows Koi Stealer through shared infrastructure, a matching message fingerprint and memory stream marker, and similar target applications.

For attribution, the team applied an attribution diamond model across tools, infrastructure and victimology, and assigned the activity to a North Korean cluster without naming a subgroup. The closing advice covers three points: people should distrust code from unsolicited recruiters, macOS is a heavily targeted platform for DPRK actors, and organizations should run intelligence-driven threat hunting focused on risks to their sector.