Lazarus Group is conducting an active campaign distributing the Mach-O Man malware kit targeting macOS systems primarily in fintech, crypto, and other high-value environments. The infection vector involves social engineering via fake Telegram meeting invitations redirecting victims to fake collaboration platforms. Victims execute terminal commands that install a suite of Go-based Mach-O binaries comprising a stager, profiler, persistence mechanism, and stealer. The malware collects sensitive data including credentials, browser information, and Keychain entries, and exfiltrates it over Telegram. The campaign uses native macOS binaries and social engineering to bypass traditional EDR detection, facilitating account takeover and unauthorized access. Indicators include malicious domains, IPs, URLs, and file hashes associated with the campaign. There is no CVE or patch information available, and no known exploits in the wild have been confirmed.

This malware campaign enables attackers to steal sensitive credentials and data from macOS systems, potentially leading to account takeover, unauthorized access to infrastructure, and financial loss. The use of social engineering and native binaries allows the malware to evade detection by common security tools, increasing the risk of successful compromise in targeted environments. Primary targets are businesses in fintech, cryptocurrency, and other sectors where macOS usage is prevalent, making these organizations particularly vulnerable.

No official patch or remediation guidance is currently available for this malware. Organizations should be aware of the social engineering tactics used, such as fake meeting invitations via Telegram and fraudulent collaboration platforms, and educate users to avoid executing untrusted terminal commands. Monitoring for indicators of compromise such as the listed malicious domains, IP addresses, URLs, and file hashes can aid detection. Since the malware uses native macOS binaries to evade traditional EDR, consider employing behavioral detection tools and network monitoring for unusual Telegram traffic. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources regularly for updates.