Lazarus Group is a North Korean state-sponsored hacking group whose Mac malware, AppleJeus, has posed as cryptocurrency trading apps since at least 2018. If you installed a trading app from a site an email or message steered you to, stop using that Mac for crypto, disconnect it and get professional help.
Last reviewed · 3 sources
Also known as: AppleJeus, Lazarus APT macOS, HOPLIGHT
Lazarus Group is a North Korean state-sponsored group attributed to the Reconnaissance General Bureau and active since at least 2009 (MITRE ATT&CK). A 2021 joint advisory led by CISA says North Korea has used AppleJeus malware posing as cryptocurrency trading platforms since at least 2018, against cryptocurrency exchanges, financial service companies and individuals. Trojanized apps such as Celas Trade Pro and JMT Trading came in Windows and macOS versions; the Mac version installed an updater inside the app and a hidden plist in LaunchDaemons to keep it running.
Trojanized cryptocurrency trading apps from fake companies (AppleJeus)
Emails linking to a convincing company website with a Mac download (CISA)
Installers that add a LaunchDaemon so the malware runs at startup
You installed a crypto trading app from an exchange or company you can't verify
An app named Celas Trade Pro or JMT Trading, or similar, from outside the App Store
A plist such as .com.celastradepro.plist in /Library/LaunchDaemons
Crypto transactions you didn't make
Disconnect from all networks. State-backed malware may give attackers ongoing access, so treat this as a serious incident.
Before cleaning up, make a disk image or Time Machine backup for investigators, in case the full scope needs to be worked out.
Delete the app and its LaunchDaemons plist, and check ~/Library/Application Support and ~/Library/LaunchAgents for related files.
Move funds to new wallets created on a device you trust, and revoke token approvals made from this Mac.
CoreLock's free scan checks startup items, but state-sponsored malware can go beyond what any consumer scan finds. Consider professional incident response.
Check a crypto platform through several independent sources before installing its app
Be suspicious of unsolicited messages that ask you to install software
Keep significant crypto holdings in a hardware wallet
Prefer exchanges' official apps from the Mac App Store or their verified website
What it can and can't do
AppleJeus keeps itself running with a LaunchDaemons plist, the kind of item the startup-items check in CoreLock's free scan covers. State-sponsored malware can go beyond what any consumer scan finds, and CoreLock can't promise to catch every variant.
Trojan — Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean ...
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Ransomware — EvilQuest, also named ThiefQuest, was found in 2020 in trojanized pirated Mac ap...
MITRE ATT&CK describes it as a North Korean state-sponsored group attributed to the Reconnaissance General Bureau, active since at least 2009. Its macOS malware includes AppleJeus, which poses as cryptocurrency trading software.
The CISA-led advisory says it targets individuals and companies, including cryptocurrency exchanges and financial service companies, through trading apps modified to include malware.
Look the company up through sources it doesn't control, check how long its domain and app have existed, and prefer apps from the Mac App Store or a well-known exchange's official site. Be wary when an email or message is what led you to it.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser