High-level fintech and cryptocurrency executives and developers using macOS

Date (as written): 21/04/2026
Year: 2026
Country: Global
Actors (as written): Lazarus Group (aliases: Hidden Cobra, APT38, Zinc, Labyrinth Chollima)
Actor pages: Lazarus Group
Tags (as written): Attack: Malware; Target Class: Finance/Insurance; Attack Class: Cyber Espionage Cyber Crime; Initial Access: T1204.001 - User Execution: Malicious Link

Source entries (1)

Hackmageddon cyber attacks timelines (Paolo Passeri)

High-level fintech and cryptocurrency executives and developers using macOS · 21/04/2026

Researchers at ANY.RUN reveal that the threat actors from Lazarus Group are targeting high-value fintech and cryptocurrency individuals with the "Mach-O Man" malware kit, using social engineering to execute commands that exfiltrate credentials, Keychain data, and browser sessions. [Date Occurred: During April 2026; Date Discovered: During April 2026]

https://www.hackmageddon.com/2026/05/08/16-30-april-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/e/2PACX-1vTbUD4I3wQ1E1jETF6dbBelX6hJcQlgbij6JChX-YeotprThdKtAQeN9ejPXdVBeiQDhudcNBWK5HlY/pub?gid=1060075184&single=true&output=csv

https://www.securityweek.com/north-korean-hackers-use-applescript-clickfix-in-fresh-macos-attacks/

Suggest a correction on GitHub