Hacking MacOS: Russian Style

In this episode, we break down four major cyber security stories shaping the threat landscape: North Korean hackers targeting developers through malicious open-source packages, the new PamStealer macOS malware using stealthy AppleScript and Rust-based tradecraft, prompt injection research showing how LLMs can be manipulated through role confusion, and Google’s disruption of the NetNut residential proxy network.

We go deep into the technical details behind software supply chain attacks, malicious npm and developer tooling abuse, macOS infostealers, PAM-based password theft, AI security risks, LLM jailbreak techniques, residential proxy botnets, Badbox 2.0, and how attackers hide behind trusted infrastructure.

This episode is built for cyber security professionals, threat hunters, SOC analysts, red teamers, blue teamers, developers, AI security researchers, and anyone who wants to understand how modern attackers abuse trust across code, endpoints, AI systems, and networks.

Topics covered include North Korean cyber operations, Contagious Interview, Famous Chollima, PolinRider, PamStealer, macOS malware, prompt injection, LLM security, AI jailbreaks, NetNut, residential proxy networks, Google Threat Intelligence, supply chain security, malware analysis, and advanced threat detection.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: cyberinvestigationsau@gmail.com

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: cyberinvestigationsau@gmail.com

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

Transcript

SPEAKER_00 0:04

Welcome back to the show. Today we're looking at four stories that all have the same uncomfortable theme. And that theme is that attackers are getting very good at abusing trust boundaries that defenders assumed were previously impenetrable. So let's jump straight into the first story. It looks like North Korea is back at it. It's being reported Pollen Rider, a campaign with public attribution linked to North Korea, is associated with a crew known as Contagious Interview. This is at least what MITA is referring to them as, also known as famous Cholima. This is the same broader cluster that targets software developers and crypto workers through fake recruiting, fake technical assessments, and malicious code samples. What makes Pollen Rider interesting is the scale and the placement. So Socket reported 162 malicious release artifacts across 108 packages and extensions, typically spread across NPM, packagist, Go modules, and Chrome extensions. That tells us this is not just quote unquote one bad package on NPM. We can see here that there is a multi-ecosystem supply chain operation developing. The tradecraft here is primarily directed at developers. Attackers compromise legitimate repositories or maintainer accounts, then insert obfuscated JavaScript loaders into files that developers would normally trust. So for example, config files, build files, even fake font files. One technique is to hide JavaScript inside a fake WAF2 file and then wire up a VS Code task file so that Node.js executes it automatically when the project folder is opened. That matters because VS Code can be configured with run on open folder. So the infection does not require a developer to run npm install and then notice a suspicious post install script. Opening a repository in the editor can be enough to trigger the execution. This is very clear abuse of developer ergonomics. Developers expect tooling to run automatically. Linters, formatters, dev servers, build tasks, test watches. Pollen writer hides inside that assumption. There's also a second layer of deception that we're seeing, and that's git history rewriting. The attackers use force pushes and anti-dated commits to make malicious changes appear older and less suspicious. So a defender looking at only the GitHub landing page might see a normal-looking repo with old timestamps, but the activity log may show a recent force push that rewrote history. This is the key lesson. Commit history is not always evidence of when code actually becomes malicious. Forensics needs to include registry publication metadata, GitHub activity events, package release timing, and local workstation artifacts in order to mitigate against the attacks that we are currently seeing. So what happens from there? Once the JavaScript loader executes, it reaches out to public blockchain and RPC infrastructure, which is very odd, but it shows the new infrastructure or C2 servers utilizing cryptocurrency infrastructure. So services around Tron, Aptos, and BNB, smart chain being reported as C2 infrastructure, then is being used in these types of attacks. Broadly, the loader retrieves the encrypted second stage material, decrypts it, and socket mentions embedded Tor keys, and then executes the results with an eval function. The follow-on payloads include DevPopper and Omnistealer. DevPopper is associated with command execution and remote access. Omnistealer is built for credential theft, browser data theft, wallet theft and exfiltration. So in other words, this is not just dependency vandalism. It is a path into developers' machines, source code environments, cloud credentials, SSS keys, SSS, SSH, I meant to say, if you prefer proper English, so on and so forth. So if there's any advice that I can give out is that defenders need to be very aggressive with scrubbing their machines if they identify potential IOCs. If a developer installs an affected package, treat that workstation as compromised, the entire workstation. Rebuild from a known good lock file. Rotate secrets from clean machine, not from potentially infected endpoint. The big takeaway here is that developer workstations are now a high volume and high value intrusion point. Attackers are not just attacking production anymore. They're attacking people and tools that create production. Which involves developer tooling in macOS and a new previously unseen infostealer called Pam Steeler. So Pam Steeler is a new Mac OS infostealer analyzed by JMF Threat Labs. It impersonates Macy. If you didn't know, Macy is a legitimate open source clipboard manager. The fake site uses a lookalike domain, Macyapp.com, while the real Macy is Macy.app. The initial payload is compiled AppleScript file named Macy, distributed inside a disk image. So broadly what happens is when a victim opens it, Mac OS launches script editor. The visible content is basically a decoy instruction screen telling the user to press Command F or click run. The actual malicious logic is buried much further down the file, hidden behind large white space gaps. This is not a traditional quote unquote double-click an app bundle and gatekeeper catches it. Flow. The user is being coached into running a script from script editor.quarantine attribute because the attacker is abusing a normal macOS workflow rather than relying on a conventional executable launch. So the first stage, the dropout. Instead of shelling out obvious commands like curl and z shell or something like that, it uses JavaScript for automation, JXA, and calls native Objective-C APIs through the bridge. The downloader uses NSURL session to retrieve and stage the second stage. That reduces noisy process creation. From an EDR perspective, fewer child processes means fewer classic detection hooks. The dropper also performs environment aware checks, which is really interesting and quite advanced. It derives a key from host traits such as CPU architecture, locale, keyboard layout, and time zone. That key unlocks encrypted configuration containing the payload URL and install path. So what this means is if the host does not match the expected target profile, for example, if it's an uh if it is Intel rather than Apple Silicon, the config does not unlock and the malware quietly exits. Wow. That is high-level stuff. It also includes regional exclusion checks from Russia, Belarus, Kazakhstan, and other nearby regions using time zone, locale, and keyboard inputs. If that isn't an indication as to where this strain of malware is from, I don't know what is. And that's a common criminal malware tradecraft. Avoid infecting regions that may create legal or operational risk for the operators. So if you thought that we were in high-level hacking techniques, here's where things get even crazier. When the checks pass, the dropper stages a fake app bundle under the user's library path. With names like finder.app or softwareupdate.app, it copies legitimate looking icons, writes an info.p list, signs the bundle, ad hoc using code sign, launches it hidden, and drops marker files such as .me. Then stage 2 is the real stealer. Oof. An arm64 mark O, written in Rust. Rust is not the dominant language in macOS Steelers, where Swift, Go, and Objective C and SAP and AppleScript are more common. That alone can complicate analysis, especially when strings are decoded at runtime and the binary is stripped. So I I understand I'm getting quite technical, but it's this technical stuff that I think is is so fascinating when analysing hacker trade craft. So there's just a little bit more, and this is this is the cherry on top. Once it gets to stripping the binary, the Steeler bundles SQLite and reads database files directly. That is irrelevant because browser credentials, cookies, wallet sessions, and app state are often SQLite backed. It also includes security.framework at runtime rather than linking it in the static import table, reducing what static analysis immediately reveals about keychain access. The behavior that gives Pam Stealer its name is password theft through Pam. Pluggable authentication modules. The malware shows a native looking NSAlert, password prompt, pre-fills the account name, and asks the user to enter the password. But instead of blindly stealing whatever the user types, it validates the password locally with PAM underscore start, pam underscore authenticate, and pam underscore end. That's the big stealth improvement. Many commodity macOS stealers call utilities like DSCL, security, or OSA script to validate or use credentials. Pam Stealer avoids that process chain. If the password is wrong, it simply prompts again. If it is right, the attacker gets a verified login password. The malware also monitors the clipboard by repeatedly spawning PB paste and it maintains persistence in two ways. Through a modern SMapp service API and through a helper binary that uses the legacy login items interface. Redundant persistence is important because if one method is cleaned up, the other may survive. So for detection, JMF highlights some useful signals. If you are in an environment and you think you might have been infected by Pam Stealer, script editor, you ask yourself if script editor is making unusual network requests. Is script editor spawning code sign against a bundle of application support? Is a fake finder process running from a user writable directory? These are some common IOCs attributed to Pam Stealer. So the lesson here is that macOS malware has matured. It is not just crude Apple script stealers anymore. Pam Stealer uses native APIs, encrypted configuration, local password validation, delayed prompts, system map masquerading, and multiple persistence mechanisms. Wow. I think that is a piece of hacking wizardry. I know we got into the technical weeds of it, and let me know if this was too much of a technical podcast. This is what I'm trying to achieve here in Cyber Investigations, where I don't want to give you the information you probably have already read in the news if you're in the industry of InfoC. I want to give you those technical details and then we can all level up together. Thank you very much for listening to the show. Please leave a comment, please leave a like, all of it helps. See you next time.