Lazarus macOS malware executes payloads in memory

Lazarus Group's new macOS trojan, distributed via a fake crypto-trading app, downloads and runs payloads entirely from memory without touching disk.

Researchers analyzed a new macOS implant tied to Lazarus Group's ongoing AppleJeus campaign, distributed as a trojanized cryptocurrency trading application (UnionCryptoTrader.dmg) hosted on a purpose-built fake company site, unioncrypto.vip. The unsigned installer package drops a hidden launch daemon and a persistent binary (unioncryptoupdater) into /Library/UnionCrypto, which is executed at every boot to give Lazarus durable access to compromised crypto-exchange-adjacent hosts.

The binary performs basic system fingerprinting (hardware serial number and OS version via IOKit and SystemVersion.plist) and beacons to a C2 endpoint over HTTPS using libcurl. When the server responds with an encrypted payload rather than a placeholder '0', the malware decrypts it and uses NSCreateObjectFileImageFromMemory/NSLinkModule to map and execute the Mach-O payload directly from memory, parsing the LC_MAIN load command to locate and jump to its entry point — avoiding writing the second-stage payload to disk. If in-memory execution fails, the malware falls back to writing the payload to /tmp/updater and executing it via system() before deleting the file.

This in-memory loading technique, while previously discussed in offensive security research and seen in adware like InstallCore, had not previously been observed in public macOS malware, marking a notable evolution in Lazarus's toolset. The malware fits the group's established modus operandi of targeting cryptocurrency exchange employees with trojanized trading software, consistent with the broader AppleJeus operation first documented by Kaspersky. At the time of analysis the C2 server was live but not actively serving a second-stage payload.

Source reporting: https://objective-see.org/blog/blog_0x51.html