DPRK BeaverTail Native macOS Variant Masquerading as MiroTalk Conferencing App (InvisibleFerret Payload)

Key facts for BeaverTail native macOS variant

Detection coverage for BeaverTail native macOS variant

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4892 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BeaverTail macOS Qt Variant - Jami Binary Executed From Fake MiroTalk App Bundle

Detects execution of the native Qt/C++ BeaverTail macOS stealer (MiroTalk.app/Contents/MacOS/Jami) from the trojanized MiroTalk.dmg used in the DPRK Contagious Interview campaign, either by bundle path, by launch from a mounted /Volumes disk image, or by a known SHA-256 from the Objective-See and Intego reporting. Execution of this unsigned, non-notarized binary is the point where browser, wallet-extension and keychain theft and the InvisibleFerret download begin. Note the source reports disagree on which hash belongs to the DMG and which to the Jami executable, so all published hashes are matched.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1036
• Data sources: crowdstrike_falcon:ProcessRollup2, macos_endpoint_process_telemetry
• Severity: high
• Confidence: high

Splunk SPL

index=edr sourcetype="CrowdStrike:Event:Streams:JSON" event_simpleName=ProcessRollup2 event_platform=Mac ```BeaverTail macOS Qt variant - Jami Mach-O inside fake MiroTalk.app or known-bad SHA256```
| where like(ImageFileName,"%/MiroTalk.app/Contents/MacOS/Jami") OR like(ImageFileName,"/Volumes/%/MiroTalk.app/%") OR SHA256HashData IN ("9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c","0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132","10f86be3e564f2e463e45420eb5f9fbdb14f7427eac665cd9cc7901efbc4cc59","f08e88c7397443e35697e145887af2683a83d2415ccd0c7536cea09e35da9ef7")
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentBaseFileName) as parent_process values(CommandLine) as command_line values(SHA256HashData) as sha256 by ComputerName UserName ImageFileName
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let known_bad_sha256 = dynamic(['9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c','0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132','10f86be3e564f2e463e45420eb5f9fbdb14f7427eac665cd9cc7901efbc4cc59','f08e88c7397443e35697e145887af2683a83d2415ccd0c7536cea09e35da9ef7']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath endswith '/MiroTalk.app/Contents/MacOS/Jami' or (FolderPath startswith '/Volumes/' and FolderPath contains '/MiroTalk.app/') or SHA256 in (known_bad_sha256)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: BeaverTail macOS Variant Executed From Fake MiroTalk App Bundle
id: 7c1e4a52-3b9d-4f60-8a17-2d5e9b0c6f31
status: experimental
description: Detects execution of the BeaverTail Qt/C++ Mach-O named Jami from a trojanized MiroTalk.app bundle or from a mounted disk image volume, as used by the DPRK Contagious Interview campaign.
references:
    - https://objective-see.org/blog/blog_0x7A.html
    - https://attack.mitre.org/software/S1246
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1036
logsource:
    category: process_creation
    product: macos
detection:
    selection_bundle:
        Image|endswith: '/MiroTalk.app/Contents/MacOS/Jami'
    selection_volume:
        Image|startswith: '/Volumes/'
        Image|contains: '/MiroTalk.app/'
    condition: 1 of selection_*
falsepositives:
    - Legitimate MiroTalk desktop client installed from the official vendor
level: high

Known false positives:

• Legitimate MiroTalk client installed from the official vendor site and run from a mounted volume
• Security researchers detonating the Objective-See published sample in a lab

Tuning notes: Replace index=edr and the CrowdStrike sourcetype with your macOS EDR index. Exclude lab hosts by ComputerName. Re-verify hashes against the published samples before relying on the hash clause, since sources disagree on which hash is the DMG and which is Jami. The path clause is the durable one if the binary is rebuilt.

• 🔒 Trojanized [indicator] Download From Cloned MiroTalk Site or Known-Bad Hash · unlock with TL Creds
• 🔒 InvisibleFerret Python Downloader Staged in [indicator] or Running [indicator] · unlock with TL Creds
• 🔒 Non-Browser Process Connecting To Public IP On TCP/1224 (BeaverTail C2 Port) · unlock with TL Creds
• 🔒 BeaverTail Jami Binary Spawning Python or Shell Downloader · unlock with TL Creds
• 🔒 AnyDesk Installed or Launched By Script and Python Keylogger Indicators (BeaverTail Follow-On) · unlock with TL Creds
• 🔒 BeaverTail InvisibleFerret C2 HTTP Endpoints in Proxy Logs · unlock with TL Creds
• 🔒 BeaverTail Credential and Wallet Extension Theft - Keychain and Browser Profile Access From Non-Browser Process · unlock with TL Creds
• 🔒 BeaverTail InvisibleFerret C2 and Staging Infrastructure - Connections and DNS to Known and Community Indicators · unlock with TL Creds

Indicators of compromise for BeaverTail native macOS variant

As of 2026-10-31, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-4892.

Sample indicators (3 of 26)

• IP address: 95.164.17[.]24
• Domain: mirotalk[.]net
• File hash: 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

How BeaverTail native macOS variant works

BeaverTail is an information stealer and downloader attributed to North Korea-linked operators of the Contagious Interview campaign (MITRE G1052; also tracked as DeceptiveDevelopment and CL-STA-0240). Earlier variants were JavaScript, typically delivered through trojanized npm packages and code repositories. In July 2024 Objective-See (Patrick Wardle) analyzed a new native macOS build, recompiled in C++ with the Qt/QMake framework, that is shipped as MiroTalk.dmg.

Delivery is by social engineering around fake hiring and meeting scenarios. Intego reports victims were approached on LinkedIn with fake job offers and sent to download a 'MiroTalk' videoconferencing client. The DMG was hosted at https://mirotalk.net/app/MiroTalk.dmg, a clone of the legitimate MiroTalk service (meet.no42.org). One reported victim was also asked to move the conversation to Telegram and given a malicious GitHub repository. The DMG is unsigned and not notarized. The embedded Mach-O executable (MiroTalk.app/Contents/MacOS/Jami) is a 64-bit Intel binary that was undetected on VirusTotal at the time of analysis.

Once run, the binary searches for Local State files and wallet extension data in Google Chrome, Brave and Opera. It embeds the IDs of six cryptocurrency wallet browser extensions and targets the user's login keychain (~/Library/Keychains/login.keychain-db). Symbol names such as fileUpload(), pDownFinished() and upLDBFinished() indicate upload and remote payload download functionality. The binary talks over HTTP to a hard-coded C2 at 95.164.17.24:1224 (Stark, AS44477). Observed endpoints are /uploads (exfiltration), /pdown (payload download), /client/99 (returns the Python script main99.py), /payload/5346/root (InvisibleFerret backdoor) and /brow/5346/root (browser stealer).

The Python downloader sets sType='5346' and gType='root', points to http://95.164.17.24:1224, and stages payloads in a '.n2' directory under the user's home. It fetches variants for Windows, macOS (Darwin) and Linux. Intego additionally reports keylogging and installation of AnyDesk. The C2 had been active for more than a month before the 2024-07-15 publication, and a victim reported the lure on Reddit on 2024-06-11.

No CVE or CVSS applies: the threat relies on user execution of a trojanized installer. Severity is analyst-assigned. Note on hashes: the source page lists 9abf6b93... as the MiroTalk.dmg SHA-256 and 0F5F0A3A... as the Jami executable SHA-256; Intego lists 9abf6b93... plus two further hashes (10f86be3..., f08e88c7...) without stating file roles. Re-verify hashes against the published samples before blocking.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Credential Access

T1056.001 Input Capture: Keylogging; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Execution

T1059.006 Command and Scripting Interpreter: Python; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery; T1217 Browser Information Discovery

Initial Access

T1566.003 Phishing: Spearphishing via Service

Impact

T1657 Financial Theft

Remediation for BeaverTail native macOS variant

Immediate actions

• Block 95.164.17.24 (TCP/1224) and mirotalk.net at the network perimeter and DNS
• Hunt endpoints for MiroTalk.app, the Jami executable, the ~/.n2 directory and main99.py
• If a host ran the app, treat browser credentials, wallet seed/keys and keychain contents as compromised; rotate credentials and move crypto assets
• Remove any unexpected AnyDesk installation and Python processes launched from user-writable paths

Workarounds

• Only install conferencing software from verified vendor sites
• Do not run code or installers supplied during a hiring process outside a disposable VM

Longer-term hardening

• Enforce Gatekeeper and block execution of non-notarized applications (for example BlockBlock-style controls or MDM policy)
• Deploy egress monitoring that flags unknown outbound HTTP to non-standard ports (for example LuLu-style firewalls)
• Train staff and developers on fake recruiter and interview lures, including requests to download meeting clients or clone repositories

Affected and fixed versions

• Apple — macOS (user installs of the trojanized MiroTalk.dmg)
  Vulnerable versions: Any macOS host where the unsigned DMG is executed
• Google / Brave / Opera — Chrome, Brave and Opera browser profiles and crypto wallet extensions
  Vulnerable versions: Any version; data theft, not a software flaw

Timeline of BeaverTail native macOS variant

• 2023-11-01 Palo Alto Networks Unit 42 first discloses the Contagious Interview campaign (November 2023; day not stated in sources), in which locked-ioc-24 downloads the Python locked-ioc-20 backdoor.
• 2024-06-11 A victim reports the fake-job / MiroTalk lure on Reddit, the earliest documented report cited by Intego.
• 2024-07-15 Objective-See releases the malware samples publicly on GitHub (archive password 'infect3d') for researchers and detection engineers.
• 2024-07-15 Objective-See publishes analysis of the native Qt/C++ macOS locked-ioc-24 variant (locked-ioc-23, Jami executable, locked-ioc-20 payload endpoints).
• 2024-07-15 C2 locked-ioc-21:1224 is observed with more than a month of prior activity; locked-ioc-22 hosts locked-ioc-23 as a clone of the legitimate MiroTalk site.
• 2024-10-09 Trade press (The Hacker News, reposted 2024-10-09) reports DPRK actors continuing to use fake interviews to deliver cross-platform locked-ioc-24/locked-ioc-20 malware, showing the campaign persisted after this variant.

Sources cited for BeaverTail native macOS variant

• MITRE ATT&CK: BeaverTail (S1246) MITRE · Research
• Bored BeaverTail, InvisibleFerret Yacht Club: A Lazarus Lure Pt 2 (eSentire TRU) esentire.com · Research
• InvisibleFerret Malware: Technical Analysis (ANY.RUN) any.run · Research
• This Meeting Should Have Been an Email (Objective-See, Patrick Wardle) objective-see.org · Blog · 2024-07-15
• BeaverTail and InvisibleFerret malware target job-seeking Mac users (Intego) intego.com · Blog
• N. Korean Hackers Use Fake Interviews to Infect Developers with Cross-Platform Malware (The Hacker News) The Hacker News · News

More in malware

• ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)
• VOLTA-AUTODOXER: AI-Powered Windows Infostealer Ranks Stolen Data by Monetization Value
• Infostealers Weekly Report 2026-10-26 to 2026-11-02: Generic Stealer, Warden Stealer, Acreed, Remus, Vidar
• CyberStrikeAI: AI-orchestrated pentest/C2 framework used in real-world attacks on educational institutions in Africa and Latin America
• Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders)