“Contagious Interview” Goes macOS: North Korean Hackers Deploy Stealthy “DriverFixer” Stealer

A new macOS-targeting tool, DriverFixer0428, has been uncovered as part of the Contagious Interview campaign, aimed at tricking job seekers and developers into installing malware under the guise of technical interviews. A security researcher, LunchM0n3y, describes DriverFixer0428 as a stealthy credential stealer that masquerades as a legitimate system utility to bypass defences.

The malware harvests user credentials through social engineering dialogues that impersonate macOS system prompts and Google Chrome permission requests, then quietly bundles and ships them out. To evade network monitoring, it communicates with Dropbox rather than known malicious domains, a tactic noted as consistent with nation-state threat actors using legitimate cloud services for command-and-control.

DriverFixer0428 also features multi-layer sandbox evasion, detecting virtual machines or analysis environments and entering an idle state to avoid triggering its payload. The sample’s internal name and build-date implication point to an April 28th date, and the analysis concludes with high confidence that it is attributed to North Korea’s Contagious Interview campaign. December 25, 2025.