Cybersecurity Alert: macOS Malware “KandyKorn” in Circulation

North Korean hacking entities, believed to be associated with the well-known Lazarus Group, have been actively targeting cryptocurrency exchanges, deploying a new strain of macOS malware known as KandyKorn. The attackers have been reported to impersonate blockchain engineers on popular platforms like Discord to lure their victims.

Ingenious Social Engineering Tactics

Elastic Security Labs, a cybersecurity research firm, has uncovered that these cybercriminals use advanced social engineering tactics. They trick unsuspecting victims into downloading a ZIP file containing the malware, disguised as a cryptocurrency arbitrage bot, a tool designed to take advantage of price differences between exchanges.

Watcher.py: The Trigger for KandyKorn

The initial infection starts with the victim downloading a Python file, which subsequently downloads and executes Watcher.py. This script is the gateway to the infection chain known as REF7001, leading to the execution of the KandyKorn malware.

Capabilities of the KandyKorn RAT

KandyKorn operates as a remote access trojan (RAT) and a backdoor. It boasts a variety of malicious capabilities, including data exfiltration, executing directory listings, secure file deletion, and managing file uploads and downloads.

Stealthy Communication Tactics

The Elastic researchers noted that KandyKorn stands out for its communication protocol with its command-and-control (C2) server. The malware awaits commands rather than continuously polling for them, which reduces its footprint and chances of being detected.

Ongoing Threat Activity Since April 2023

The malware campaign is believed to have commenced in April 2023 and remains active. The cybercriminals continue to refine their tools and techniques, with RC4 key encryption for KandyKorn C2 and Sugarloader being the latest developments.

Rising Concerns Over Cryptocurrency Exchange Security

This latest attack vector reiterates that macOS users are not immune to sophisticated malware campaigns, especially in the lucrative cryptocurrency sector. The Money Mongers, an independent think tank, has reported significant losses in the crypto industry due to such cyber attacks, with a staggering $12.36 billion lost since 2011.

A Yearly Snapshot of Crypto Hacks

According to their data, 297 crypto-related hacking incidents have occurred this year alone, translating to an industry loss of approximately $216,000 every hour. Chainalysis’s reports highlight 2022 as the most detrimental year for crypto businesses, with losses summing up to $3.8 billion due to hacks.

Record-Breaking Thefts by the Lazarus Group

Notably, the Lazarus Group, reputedly backed by the North Korean government, has been implicated in the theft of an extraordinary $1.7 billion in cryptocurrencies across various hacking operations, setting a new record for the group’s criminal activities.

Enhanced Security Measures: A Call to Action

The findings by The Money Mongers underscore an urgent call for fortified security measures within the cryptocurrency domain. As the threat landscape evolves, so too must the industry’s defense mechanisms to safeguard against these increasingly sophisticated cyber threats.

For the Latest Crypto News follow the Coinography and Subscribe our YouTube channel or follow us on social media platforms like Twitter, Facebook, Instagram and LinkedIn.

Top Recommended Articles

• Read Also: Best Web3 Coins To Invest In
• Read Also: Best Low Cap Crypto To Buy Now
• Read Also: Best Crypto Utility Tokens
• Read Also: Best Crypto To Buy Right Now Reddit
• Read Also: Best Crypto Under $1
• Read Also: Best Penny Crypto Coins To Invest In
• Read Also: Best Shitcoins To Buy Right Now
• Read Also: Best Crypto Presale To Buy Now
• Read Also: Best Low Supply Cryptocurrency
• Read Also: Best DeFi Coins To Buy Now
• Read Also: Best Altcoins To Invest In Right Now
• Read Also: Best Crypto ICO To Invest In
• Read Also: Next Crypto To Explode In 2023
• Read Also: Best Cryptocurrency Coins To Buy
• Read Also: New Cryptocurrencies To Invest In

Ahmed Falah

Hi, I’m Ahmed Falah. I work at the intersection of technology, finance, and human well-being, exploring how emerging digital systems can create sustainable and impactful growth across businesses and society.

As a senior author at Coinography, I write deeply researched content on blockchain ecosystems, tokenomics, decentralized finance, on-chain analysis, and the societal implications of Web3. My approach blends technical clarity with purpose-driven thinking, helping readers understand complex crypto concepts in a meaningful and accessible way.

Vision & Focus

Throughout my career, I have worked closely with hedge funds, enterprises, and high-net-worth investors, helping them navigate digital transformation and develop strategies rooted in data, transparency, and sustainable growth. I see technology not merely as a financial tool but as a foundation for creating healthier, more resilient organizations.

My writing focuses on a wide range of themes, including blockchain and decentralized financial models, token utility and ecosystem design, AI and blockchain convergence, the evolution of digital market infrastructure, purpose-driven and wellness-aligned leadership, and the future of work, finance, and organizational well-being.

I am deeply committed to building systems that empower individuals and support ethical innovation. My goal is to connect technology with human values and contribute to a future where digital ecosystems uplift people, communities, and businesses in meaningful and sustainable ways.

Professional Links

Website: https://coinography.com LinkedIn: https://ae.linkedin.com/in/ahmedfalah

Let’s Connect

If you’re interested in the future of blockchain, digital transformation, decentralized systems, or well-being-focused leadership, feel free to connect with me.