According to CertiK, Lazarus Group’s Mach-O Man campaign uses fake meeting invitations and apparently routine business calls to trick crypto and fintech targets into compromising macOS systems.
The claim is well supported by the Bybit-distributed press release titled "AI empowered Bybit Security Team Uncovers macOS Malware Campaign Targeting Users Searching for Claude Code" and the related PR Newswire UK item, both of which describe a macOS malware campaign abusing Claude Code search intent through SEO poisoning and fake installer redirection. Those sources also state that the malware targeted more than 250 browser-based wallet extensions. The secondary report from BlockBeats independently matches those details and adds timing around mitigation. While I could not directly fetch Bybit’s own website or the exact supplied X posts due tool limits, the available Bybit-attributed primary distribution and consistent secondary coverage make the claim likely true.
The Lazarus Group-linked Mach-O Man macOS malware campaign is described by CertiK as a targeted operation against crypto and fintech executives that relies on social engineering, including fake online meeting invitations and apparently routine business calls. According to existing reporting, the campaign has also involved ClickFix tactics, SEO poisoning, fake Claude Code installation pages, fraudulent websites, and attacks on browser wallet extensions. Bybit previously said the operation targeted wallet credentials and device access, while CertiK attributed the activity to Lazarus Group and said it sought access to company and financial systems. The combined reporting indicates a macOS-focused campaign centered on deceptive communications and malicious prompts to compromise high-value industry targets.