SECURITY researchers have identified a campaign in which fake macOS installers masquerade as legitimate utilities to deliver a backdoor known as OtterCookie. The attackers have trojanised disk images (DMG) and installer packages (PKG) that impersonate apps such as Presentify, The Unarchiver, Sketch2026.2, SiteSucker Pro, RAR Extractor Max, Mp3tag, and others.
The operation is linked to the Contagious Interview cluster, a threat actor group widely associated with North Korea, with independent analyses from Jamf Threat Labs, Elastic Security Labs and CITIZENDOT corroborating the attribution. Victims targeted include software engineers, job candidates and Web3 developers, with the attackers leveraging a fake interview pretext to coax recipients into running the malicious installers.
Technically, the attackers modify the internal bundle structure of each target program, altering the Info[.]plist to execute a hidden binary named .macos that bypasses Apple’s quarantine and presents a decoy app while the background component retrieves a remote payload. In the PKG variant, a postinstall script installs a malicious script into the Application Support directory, then fetches a second-stage script from a remote server.
The second stage downloads an official Node[.]js runtime (Intel builds via Rosetta 2 on Apple silicon), pulls parser[.]js and dependencies, and then executes the Node process to run the final payload. The OtterCookie backdoor features a Socket[.]IO channel for command and control, in-memory credential theft for browsers and wallets, local filesystem scanning for private keys, and a clipboard extractor using pbpaste.
Researchers note the installers are unsigned, which Gatekeeper would block by default, suggesting the operators are testing delivery channels rather than carrying out broad attacks. Practically, organisations should tighten Gatekeeper controls, monitor for unusual Rosetta 2 activity and pbpaste usage, and educate staff to recognise fraudulent recruitment efforts demanding third‑party software.