MacMalware_2023.pdf (14 MB)

Objective-See's 2023 macOS malware roundup says Lazarus Group, identified as DPRK-linked, continued to produce macOS malware during 2023. The DPRK 3CX supply chain compromise trojanized the macOS 3CX Desktop App by injecting libffmpeg.dylib, then used the trusted app launch path to survey infected systems and fetch a second-stage UpdateAgent payload. The same APT section also covers NokNok, RustBucket, and payloads tied to the JumpCloud supply chain attack, framing them as part of the year's macOS APT activity rather than commodity ransomware.