North Korean hackers, most likely from the Lazarus group, targeted macOS crypto users using malware called “KANDYKORN” distributed on Discord. They pose as blockchain developers and offer tools for crypto arbitrage. Victims are lured into downloading a ZIP archive called "Cross-platform Bridges zip", which contains various malicious modules that collect information, perform malicious operations and follow the hacker's commands.

▪️Telegram ▪️X

▪️Community ▪️Source