VB2020-Devadoss.pdf (2 MB)

K7 Computing analyzes Lazarus macOS malware innovation around Union Crypto Trader and related cryptocurrency-targeting campaigns. The source describes trojanized trading applications delivered through phishing and fake websites, signed installers, post-install scripts that move LaunchDaemon persistence files and backdoors, and a MemoryBasedBundle technique that executes Mach-O code directly from memory to evade disk-based detection. It also notes malicious documents targeting Korean users whose macros deliver OS-specific payloads, showing Lazarus’ expanding macOS toolchain across Objective-C, Swift, C, QT, and fileless execution.