macOS users are being targeted by malware that imitates legitimate PDFs

One New malware masquerades as a legitimate PDF reader for macOS It is used for attacks targeting Apple devices. The malicious file, dubbed “TodoSwift”, was discovered by researchers at Kandji, who provided more details about the campaign last Friday (16).

According to the platform specializing in the management and security of Apple devices, The malware is hidden in an app called TodoTasksWritten in Swift (hence the name), this software presents itself as a supposedly harmless tool for downloading, reading and editing files in PDF format.

Once the victim installs the program on their device, TodoSwift comes into play: It downloads a secondary malicious file, making it harder to detect. The action begins with a PDF being displayed containing information about bitcoin and artificial intelligence to distract the person..

The software displays the file hosted on Google Drive on the screen triggers the transfer of the malicious payload from a second URLIn this way, the malware installs itself on macOS without any knowledge of the user, giving cybercriminals the opportunity to act remotely.

North Korean hackers will step in

Experts responsible for the discovery He attributed this new macOS malware to BlueNoroff, a North Korean cybercrime groupThey found similarities between TodoSwift and the malicious files KandyKorn and RustBucket, which were used by these authors to steal data and cryptocurrency.

It is linked to Lazarus, the main hacker group allegedly backed by the North Korean state. BlueNoroff frequently attacks financial institutions, government agencies, and cryptocurrency exchangesRecently, the team has stood out for its high ability to evade detection and execute sophisticated cyberattacks.

If you download the TodoTasks tool, It is recommended that you delete the program and perform a security scan on the device. using a reputable antivirus. Researchers are still evaluating the malware’s capabilities and will be detailed soon.