Beware: Fake zoom update spreads Mac malware targeting ✴️

 ✴️Beware: Fake zoom update spreads Mac malware targeting ✴️

👍A new macOS malware campaign, linked to North Korean hackers, is targeting cryptocurrency and Web3 startups with a deceptive Zoom update. This sophisticated attack begins with social engineering, where attackers pose as trusted contacts on Telegram, convincing victims to schedule a Zoom call via a Calendly link.

The link leads to a fake Zoom SDK update, which is actually a malicious AppleScript.Once executed, the script downloads additional harmful software, including programs written in Nim, a rare programming language for macOS malware.

These programs use clever tricks, like process injection and encrypted communication over secure WebSocket connections, to stay hidden. The malware also ensures it persists by reinstalling itself if the system restarts or the program is stopped.

It steals sensitive data, such as Keychain passwords, browser history, and Telegram information, using simple Bash scripts.This campaign, active since April 2025, shows North Korean hackers adapting their tactics to bypass standard security measures.

To stay safe, avoid clicking suspicious Zoom links or downloading unverified updates, especially if received through Telegram. Always verify the sender’s identity and stick to official Zoom domains for updates. If you suspect your Mac is infected, use trusted antivirus software to scan and remove threats. Staying cautious is key to protecting your data in this growing crypto-targeted scam.💯