North Korea’s Lazarus Group launches new malware kit targeting macOS users in crypto, fintech

The persistent module minst2.bin drops a LaunchAgent plist file (com.onedrive.launcher.plist), which ensures the malware launches each time the user logs in by posing as a legitimate process called “OneDrive” or “Antivirus Service.” Macrasv2, the last payload responsible for stealing data from the system, collects information from browser login details and cookies found in SQLite databases […]