North Korean Hackers Use New Mac Malware NimDoor to Target Cryptocurrency Project

July 3rd. According to a report presented on Wednesday by the cybersecurity firm Sentinel Labs, North Korean hackers are employing a novel type of malware that specifically targets Apple devices to launch attacks against cryptocurrency companies. The hackers pose as trusted individuals on messaging applications such as Telegram and distribute fake Zoom update files that actually install malicious software named "NimDoor." This malware is written in the uncommon Nim programming language. This language has the ability to circumvent Apple's memory protection mechanism and deploy an information-stealing program that is specifically designed to target cryptocurrency wallets and browser passwords. The Nim language, which is renowned for its capability to run without modification on Windows, Mac, and Linux, along with its fast compilation speed and the difficulty of detection, is emerging as the new preference among cybercriminals. The malware also incorporates a script to steal the Telegram encrypted local database and decryption key. Additionally, it waits for a period of 10 minutes before activation in order to evade security scans.