Researchers at Group-IB have recently released a new report on ongoing and new threats posed by Lazarus Group’s financially-motivated campaign against job seekers. CTIX analysts discussed the emergence of this campaign in our April 30, 2024 flash. Since then, Lazarus has expanded its capabilities and has introduced new malware targeted at MacOS to steal information and cryptocurrency from job seekers in the IT and Software Development fields. The campaign is rooted in a fictitious job posting and interview process that tricks seekers into downloading a “Node.js” project containing malware. Researchers have observed updated versions of the major forms of malware used in this campaign dubbed BeaverTail and InvisibleFerret. BeaverTail is a JavaScript or Python-based InfoStealer with the ability to steal credentials stored in browsers and vaults as well as data from browser extensions and cryptocurrency wallets. InvisibleFerret is Python-based malware that acts as a backdoor, keylogger, and infostealer. Both forms of malware are under active development. The recent Python versions of BeaverTail are delivered via a simple JavaScript downloader and fetches a bundle of scripts called CivetQ to modularize the malware’s capabilities. Researchers have also noted that Lazarus has included additional job search platforms in their campaign in an apparent attempt to target professionals skilled in Blockchain. This tactic could have been introduced to increase the attackers’ likelihood of infecting a victim with cryptocurrency on their machine. Platforms added to their campaign beyond LinkedIn include WWR, Moonlight, and Upwork. They have also started using fraudulent video conferencing applications to spread the initial BeaverTail loader as an alternative initial infection vector to the fake “Node.js” project. Researchers discovered a cloned website of a legitimate free conferencing software application which hosts the fake video conference application “FCCCall”. Installers for both Windows and MacOS were discovered by researchers. CTIX analysts urge individuals to remain vigilant online and to vet potential employers prior to engaging in the job interview process. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.