North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams
Threat actors connected to North Korea have been seen using LinkedIn to target developers as part of a fictitious employment recruitment scheme.
In a recent analysis about the vulnerabilities facing the Web3 sector, Google-owned Mandiant stated that these assaults use code exams as a frequent initial infection vector.
The attacker emailed a ZIP file with COVERTCATCH malware after they had a chat interaction, according to researchers Blas Kojusner, Joseph Dobson, and Robert Wallace. The file appeared to be a Python coding challenge.
Using Launch Agents and Launch Daemons to provide persistence, the second-stage payload that the virus downloads and installs on the target's macOS system serves read more about North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Sca...