#zoomphish

**When a “Critical” Zoom Patch Becomes a Credential Harvester** A newly identified macOS malware family dubbed **ClickFix** has been linked to a North Korean state‑sponsored hacking unit. The campaign blends fabricated high‑salary job postings with counterfeit Zoom security‑update alerts to trick users into executing a malicious installer. Once installed, the payload silently harvests macOS credentials and relays them to command‑and‑control infrastructure operated from the Korean peninsula. --- ### Key Takeaways - **Attribution** – Security researchers have traced ClickFix to a known North Korean cyber‑espionage group, expanding the nation’s malware portfolio to target Apple’s desktop ecosystem. - **Attack vector** – Victims receive polished phishing emails promising lucrative employment or urging immediate installation of a “critical” Zoom security patch; the attached DMG contains the malicious payload. - **Payload behavior** – After execution, ClickFix logs keystrokes, captures saved passwords, and exfiltrates authentication tokens, enabling prolonged access to corporate networks. - **Target selection** – The campaign focuses on macOS workstations, a relatively under‑defended segment, especially in organizations that rely heavily on remote‑work tools like Zoom. - **Defensive gaps** – Many endpoint protection solutions still prioritize Windows binaries, leaving macOS devices vulnerable to novel, cross‑platform malware. - **Mitigation steps** – Verify software updates through official channels, scrutinize unsolicited job offers, and employ multi‑factor authentication to limit the impact of credential theft. - **Broader implications** – The operation underscores North Korea’s evolving strategy to diversify attack surfaces, leveraging social engineering to bypass technical safeguards. --- Stay vigilant against unsolicited software prompts and maintain rigorous verification processes for any employment‑related communications. #ClickFix #macOSMalware #NorthKorea #CredentialTheft #ZoomPhish #APT #CyberEspionage #MacSecurity #InfoSec #newsababil360 [Read Full Article](https://news.ababil360.com/north-korea-deploys-clickfix-malware-to-harvest-macos-credentials/)