type: incident · created: 2026-07-30 · updated: 2026-08-18 · tags: [cyber, digest-2026-07-31, north-korea, dprk, macos, malvertising, crypto-theft, contagions-interview] · confidence: not-rated · affected_sectors: [] · au_impact: false
🎯 IOCs · ValleyRAT
Indicators of compromise · ValleyRAT — 4 shown
205[.]186[.]112[.]235:443hxxp://ruihankj[.]top/getinstall64hxxp://fafdafaf[.]shop/getinstall64hxxp://fdsfsffdsf[.]shop/getinstall64
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
Summary
North Korean threat actors have been attributed to a sophisticated macOS malvertising campaign as part of the long-running Contagious Interview campaign. Victims are redirected to fake pages displaying a full-screen macOS software update sequence that stealthily copies an attack command to the clipboard and prompts execution via Terminal (ClickFix technique). The campaign uses blockchain-hosted C2, extracting live server addresses from Ethereum smart contracts.
Key Details
- Date: 2026-07-30
- Source: The Hacker News
- Reliability: Tier 2/4 — Established cyber journalism
- Threat Actor: DPRK (North Korea) — Contagious Interview campaign
- Target Platform: macOS
- Technique: Malvertising → fake software update → ClickFix (clipboard attack command)
- C2 Infrastructure: Blockchain-hosted (Ethereum smart contracts)
- Payload: Crypto-stealing malware
- Campaign: Long-running "Contagious Interview"
Source
See Also
- North Korea's Lazarus Group Sharing Tools with Ransomware Hackers
- Hackers Exploit AnySign4PC via Compromised Korean Websites to Install Backdoors
- SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT