North Korean‑linked Group Expands Mac Malware Campaign Beyond Git Hooks

Security researchers have identified a notable escalation in the tactics of the Contagious Interview threat actors, a group with ties to North Korea. The campaign, previously confined to malicious Git hooks embedded in code repositories, now distributes trojanized macOS applications packaged as disk images and installer files, broadening the attack surface for software developers.

The earlier phase of the operation relied on compromising version‑control workflows, inserting malicious scripts that executed when developers interacted with Git hooks. That approach allowed the actors to infiltrate development environments with relatively low visibility, but it required victims to be actively pulling or pushing code through infected repositories.

In the latest wave, the adversaries are delivering payloads disguised as legitimate macOS utilities. The trojanized apps appear as standard DMG or PKG installers, a format familiar to Mac users. Once a developer runs the installer, the hidden malware gains persistence on the system, potentially exfiltrating source code, credentials, or providing a foothold for further intrusion. Jamf Threat Labs noted that the binaries are signed with valid Apple certificates, complicating detection by conventional anti‑malware tools.

Industry analysts stress that the shift reflects a strategic move to bypass the limited reach of repository‑based attacks. By targeting the broader ecosystem of development tools and utilities, the actors can compromise a larger pool of engineers who may download third‑party applications without rigorous verification. Security firms recommend that organizations enforce strict code‑signing verification, restrict execution of unsigned installers, and employ endpoint detection that can flag anomalous macOS binaries.

The development of this macOS‑focused vector underscores growing concerns over software‑supply‑chain security. As threat groups diversify delivery mechanisms, defenders must adapt by hardening the entire toolchain, from source‑control platforms to local development machines. Continued monitoring by threat intelligence teams, combined with proactive patching and user education, will be essential to mitigate the evolving risk posed by Contagious Interview and similar actors.