Mach-O Man Malware: What CISOs Need to Know

Lazarus Group is conducting an active campaign targeting businesses through ClickFix attacks, distributing a newly identified macOS malware kit called "Mach-O Man". The attack begins with fake meeting invitations via Telegram, redirecting victims to fraudulent collaboration platforms impersonating Zoom, Microsoft Teams, or Google Meet. Victims are tricked into executing terminal commands that install the malware. The kit consists of Go-based Mach-O binaries including a stager, profiler, persistence mechanism, and stealer. The malware collects credentials, browser data, and macOS Keychain entries, exfiltrating data through Telegram. Primary targets include fintech, crypto, and high-value environments where macOS is prevalent. The campaign leverages social engineering and native macOS binaries to evade traditional EDR detection, ultimately enabling account takeover, unauthorized infrastructure access, and financial loss.

• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure VulnerabilityLowVulnerability2026-10-28
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28