The Lazarus Group-linked Mach-O Man macOS malware campaign is described by CertiK as a targeted operation against crypto and fintech executives that relies on social engineering, including fake online meeting invitations and apparently routine business calls. According to existing reporting, the campaign has also involved ClickFix tactics, SEO poisoning, fake Claude Code installation pages, fraudulent websites, and attacks on browser wallet extensions. Bybit previously said the operation targeted wallet credentials and device access, while CertiK attributed the activity to Lazarus Group and said it sought access to company and financial systems. The combined reporting indicates a macOS-focused campaign centered on deceptive communications and malicious prompts to compromise high-value industry targets.