New Lazarus APT Campaign: “Mach-O Man” macOS Malware Kit Hits Businesses

The recent wave of ClickFix attacks has introduced several new ways to compromise users, establishing itself as a technique that is likely here to stay. We have observed Lazarus Group using this method to distribute a range of malware, from well-known families to more unusual variants such as PyLangGhostRAT, a Python-based vibe-ported of the original Go version, along with other oddities.

In this article, we analyze the next stage of this campaign: a newly identified macOS malware kit that is currently being actively distributed.