DPRK macOS Malvertising: Detecting 'Contagious Interview' Fake Update Campaigns

Introduction

Threat actors attributed to the Democratic People's Republic of Korea (DPRK) have revitalized the long-running "Contagious Interview" campaign with a sophisticated macOS malvertising operation. In this latest iteration observed in July 2026, the attackers have shifted from direct social engineering lures to a malvertising scheme that redirects victims to fake web pages. These pages display a full-screen, non-existent macOS software update sequence. This tactic is a critical evolution in social engineering, leveraging the implicit trust users place in legitimate operating system update mechanisms to deliver crypto-stealing payloads. Defenders must recognize this campaign not merely as malware but as a targeted bypass of user skepticism via UI deception.

Technical Analysis

This campaign primarily targets macOS users searching for legitimate software or tools, only to be redirected via malicious ad networks to attacker-controlled infrastructure. The attack chain proceeds as follows:

1. Initial Redirect: The user clicks a seemingly legitimate advertisement, which redirects the browser to a fraudulent domain hosting the exploit kit.
2. The "Fake Update" Hook: The landing page renders a high-fidelity, full-screen replica of a macOS system update prompt (e.g., "macOS is updating"). Unlike standard web pop-ups, this interface is designed to lock the user's attention and mimic the native OS aesthetic.
3. Payload Delivery: Interacting with the prompt triggers the download of a malicious package or disk image (.dmg) under the guise of an update file. Once executed, this payload installs crypto-stealing malware, likely targeting browser-stored credentials and wallet extensions.

Affected Platforms: macOS (latest versions vulnerable to social engineering, as the OS itself is not being technically exploited but rather mimicked).

Attribution & Motivation: Linked to DPRK-nexus actors. The primary objective is financial theft via cryptocurrency exfiltration, consistent with the regime's revenue-generation tactics.

Exploitation Status: Confirmed active exploitation in the wild via malvertising channels.

Detection & Response

Detecting this campaign requires looking beyond static signatures and focusing on the behavioral anomalies of the attack chain: browsers launching system utilities to handle downloaded payloads, and the execution of unsigned binaries from non-standard paths.

Sigma Rules

The following Sigma rules identify suspicious process chains typical of this malvertising campaign—specifically, browsers spawning hdiutil to mount disk images or executing installers directly.

---
title: macOS Fake Update - Browser Spawning hdiutil
id: 9a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects browser processes spawning hdiutil to mount disk images, a common behavior in fake update scams.
references:
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains:
      - 'Google Chrome.app'
      - 'Firefox.app'
      - 'Safari.app'
    Image|endswith: '/hdiutil'
  condition: selection
falsepositives:
  - Legitimate user manual mounting of DMGs from browser downloads (rarely automated by browser)
level: high
---
title: macOS Fake Update - Browser Executing Installer
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects browsers directly launching the macOS installer command, indicative of malicious package execution.
references:
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains:
      - 'Google Chrome.app'
      - 'Firefox.app'
      - 'Safari.app'
    Image|endswith: '/installer'
  condition: selection
falsepositives:
  - Administrator automation tools
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts for browser processes initiating child processes on macOS endpoints ingested via Microsoft Defender for Endpoint.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where OSPlatform == "macOS"
| where InitiatingProcessFileName in ("Google Chrome", "Firefox", "Safari")
| where FileName in ("hdiutil", "installer", "bash", "sh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

Velociraptor VQL

This Velociraptor artifact hunts for processes spawned by common browsers that attempt to mount disk images or modify system installation states.

-- Hunt for browser processes spawning system utilities
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ "Chrome"
   OR Parent.Name =~ "Firefox"
   OR Parent.Name =~ "Safari"
   AND (Name =~ "hdiutil"
        OR Name =~ "installer"
        OR Name =~ "bash")

Remediation Script (Bash)

Use this script on potentially compromised macOS endpoints to audit the Downloads directory for unsigned or recently created disk images and packages associated with this campaign.

#!/bin/bash

# Audit Downloads for suspicious disk images/installers
LOG_FILE="/var/log/fake_update_audit.log"
DOWNLOADS_DIR="/Users/*/Downloads"

echo "Starting audit for Fake Update malware..." | tee -a "$LOG_FILE"

# Find .dmg and .pkg files created in the last 24 hours
find "$DOWNLOADS_DIR" -type f \( -name "*.dmg" -o -name "*.pkg" \) -mtime -1 -print0 | while IFS= read -r -d '' file; do
    echo "Checking file: $file" | tee -a "$LOG_FILE"
    
    # Check code signature (expect failure for malware)
    codesign -dv "$file" 2>&1 | tee -a "$LOG_FILE"
    
    # If not signed or identified as suspicious, quarantine it
    if ! codesign -v "$file" &> /dev/null; then
        echo "[!] Unsigned or invalid signature found: $file" | tee -a "$LOG_FILE"
        xattr -w com.apple.quarantine "0008;$(date +%s);Chrome;00B1A2-1234567890ABC" "$file" 2>/dev/null
        # Consider moving to a secure location for analysis
    fi
done

echo "Audit complete. Check $LOG_FILE for details."

Remediation

1. User Awareness Training: Immediately brief employees on the specific tactic of "Browser-based OS Update Prompts." Emphasize that legitimate Apple macOS updates never originate from a web browser or a full-screen web page; they are initiated via System Settings (or System Preferences) via the Apple Menu.
2. Inspect Browser Extensions: This campaign often relies on ad-injection or browser redirection. Audit installed extensions in Chrome, Firefox, and Safari. Remove any unapproved or unknown extensions immediately.
3. Network Blocking: If specific IoCs (domains/URLs) associated with the malvertising infrastructure are identified in your threat intelligence feeds, block them at the proxy/DNS level.
4. Endpoint Isolation: For endpoints where suspicious interaction with a fake update page is confirmed (via logs or user report), isolate the machine from the network and perform a full forensic scan for crypto-stealing malware.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub