Executive Summary
Jamf Threat Labs has identified a new cluster of activity within the 'Contagious Interview' campaign, attributed to the DPRK-linked Lazarus Group. The campaign has evolved from embedding malicious code in developer workflows (Git hooks and VS Code tasks) to distributing trojanized macOS application installers (DMG and PKG files). These installers impersonate legitimate tools like The Unarchiver and SiteSucker Pro to trick users into executing malicious background scripts.
The infection chain uses a multi-stage approach: trojanized binaries downloader shell scripts, which in turn fetch Node.js-based payloads including the OtterCookie remote access trojan (RAT). OtterCookie provides the attackers with comprehensive control, featuring browser credential theft, cryptocurrency wallet targeting, and clipboard monitoring. While the installers are currently unsigned—triggering Gatekeeper warnings—the shift toward generic application installers indicates a broadening of the campaign's target demographic beyond developers.