This Fake macOS Update Could Drain Your Crypto Wallet

Robert Moore · 2026-07-30

You're sitting there, browsing the web, when a pop-up appears telling you a macOS update is ready. It looks legit—full screen, official Apple styling, the works. But here's the thing: it's not real. And if you click through, you might just hand over your crypto wallet to hackers linked to North Korea. Security researchers have tied this campaign to the same threat actors behind the long-running Contagious Interview operation. This time, they're targeting Mac users with a clever bit of malvertising that redirects you to a fake page showing a full-screen update sequence. The catch? That update doesn't exist. It's purely a ruse to get you to install malware that steals your cryptocurrency. ### How the Attack Works The attack starts with malicious ads—those sponsored links you see at the top of search results. Click one, and you're whisked away to a page that looks like an official Apple update screen. It's designed to mimic the real thing so convincingly that most people won't think twice. Once you're on that page, the fake update begins to "install." It might show a progress bar, a loading spinner, or even a fake restart. All the while, the malware is quietly slipping onto your system. By the time you realize something's off, the damage is already done. Here's what makes this particularly nasty: - The fake update screen is full-screen, so it's hard to notice anything unusual in the background - The malware is crafted to steal crypto wallet credentials and private keys - The campaign has been active for months, with new variations appearing regularly ### Why This Matters for Mac Users There's a common misconception that Macs are immune to malware. That's simply not true. While macOS has solid built-in security, it's not invincible. Attackers are getting smarter, and they're specifically targeting Mac users because they tend to be less cautious. This campaign is a perfect example. The fake update screen is so polished that even tech-savvy users could fall for it. And the payoff for the attackers is significant—crypto wallets can hold thousands of dollars, making them a tempting target. ### The Contagious Interview Connection If you've been following cybersecurity news, you might remember Contagious Interview. It's a campaign that's been around for years, typically using fake job interviews to lure victims into downloading malware. This new iteration takes a different approach, swapping the job angle for fake software updates. It's a shift in tactics, but the goal remains the same: get malware onto your machine and steal whatever's valuable. The fact that they're using malvertising now suggests they're adapting to what works. And unfortunately, fake update pages are working. ### How to Protect Yourself So, what can you do to stay safe? It starts with a healthy dose of skepticism. If you see an update prompt that appears out of nowhere, don't click it. Instead, go directly to System Settings and check for updates manually. That way, you know you're dealing with the real thing. Here are a few other tips to keep in mind: - Use an ad blocker to reduce the risk of malicious ads - Keep your browser and OS updated to patch known vulnerabilities - Enable two-factor authentication on your crypto accounts - Consider using a hardware wallet for large holdings - Never download software from third-party sites ### The Bottom Line This campaign is a reminder that cyber threats are constantly evolving. The days of obvious, clunky scams are behind us. Today's attackers are sophisticated, patient, and willing to invest time in making their schemes look legitimate. For Mac users, the takeaway is clear: don't trust unsolicited update prompts. Take a moment to verify before you click. It might seem like a hassle, but it's a small price to pay for keeping your crypto safe. After all, losing your savings to a fake update screen is a mistake you'll only make once—and unfortunately, for some, that's all it takes.