MACOS FLEXIBLEFERRET | FURTHER VARIANTS OF DPRK MALWARE FAMILY UNEARTHED

Summary from the TLDR InfoSec newsletter

The Ferret family of malware is used by the Contagious Interview campaign targeting developers using macOS. The campaign involves victims being sent a link to communicate with an interviewer that throws an error and prompts the user to download a trojanized virtual meeting software which installs a Go backdoor and stealer. The newest variant uses a valid Apple Developer signature and Team ID, evades the current XProtect signatures, and masquerades as a Zoom application.