North Korean Threat Actors Deploy COVERTCATCH Malware via LinkedIn Job Scams
“After an initial chat conversation, the attacker sent a ZIP file that contained COVERTCATCH malware disguised as a Python coding challenge,” researchers Robert Wallace, Blas Kojusner, and Joseph Dobson said.
The malware functions as a launchpad to compromise the target’s macOS system by downloading a second-stage payload that establishes persistence via Launch Agents and Launch Daemons.
![](https://kbin.life/media/cache/resolve/entry_thumb/68/a4/68a4f5717ea31bce9afa8601c137cadb5ae23cd6e266b60902241d62a35963c2.webp)