Hackers Abuse EV Certificates to Sign Completely Undetectable DMG Malware

Security researchers have uncovered a macOS malware campaign in which threat actors abuse Extended Validation (EV) code-signing certificates to sign DMG payloads that appear completely legitimate to macOS security checks. A fresh DMG sample was identified signed by a new Developer ID: THOMAS BOULAY DUVAL, with SHA-256: a031ba8111ded0c11acfede9ab83b4be8274584da71bcc88ff72e2d51957dd7.

The attackers acquire EV certificates through theft, illicit purchase, or abuse of compromised identity documents, enabling them to sign malware that can be installed by users before revocation notes can stop it. Once run, the DMG launches a second-stage payload known as Odyssey Stealer, a credential-harvesting trojan, after downloading it from a remote URL and executing it under the signed container.

The campaign operators also append fragments of the signer’s name to the bundle identifier to feign legitimacy, such as “balaban[.]sudoku” and “thomas[.]parfums.” According to CertCentral’s public lookup, indicators include the domain franceparfumes[.]org/parfume and the IP address 185.93.89[.]62, with the threat window potentially lasting days or weeks before certificates are revoked.