# DPRK BeaverTail Native macOS Variant Masquerading as MiroTalk Conferencing App (InvisibleFerret Payload)

> Objective-See analysis of a new, native (Qt/C++) macOS variant of the DPRK-linked BeaverTail stealer/downloader, distributed as a fake MiroTalk application (MiroTalk.dmg) from a cloned site. It steals browser data, cryptocurrency wallet extension data and the login keychain, and downloads Python secondary payloads including the InvisibleFerret backdoor.

- **Published:** 2026-10-31T08:55:07Z
- **Last reviewed:** 2026-10-31T08:55:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4892
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4892.png
- **ID:** TL-2026-4892
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

BeaverTail is an information stealer and downloader attributed to North Korea-linked operators of the Contagious Interview campaign (MITRE G1052; also tracked as DeceptiveDevelopment and CL-STA-0240). Earlier variants were JavaScript, typically delivered through trojanized npm packages and code repositories. In July 2024 Objective-See (Patrick Wardle) analyzed a new native macOS build, recompiled in C++ with the Qt/QMake framework, that is shipped as MiroTalk.dmg.

Delivery is by social engineering around fake hiring and meeting scenarios. Intego reports victims were approached on LinkedIn with fake job offers and sent to download a 'MiroTalk' videoconferencing client. The DMG was hosted at https://mirotalk.net/app/MiroTalk.dmg, a clone of the legitimate MiroTalk service (meet.no42.org). One reported victim was also asked to move the conversation to Telegram and given a malicious GitHub repository. The DMG is unsigned and not notarized. The embedded Mach-O executable (MiroTalk.app/Contents/MacOS/Jami) is a 64-bit Intel binary that was undetected on VirusTotal at the time of analysis.

Once run, the binary searches for Local State files and wallet extension data in Google Chrome, Brave and Opera. It embeds the IDs of six cryptocurrency wallet browser extensions and targets the user's login keychain (~/Library/Keychains/login.keychain-db). Symbol names such as fileUpload(), pDownFinished() and upLDBFinished() indicate upload and remote payload download functionality. The binary talks over HTTP to a hard-coded C2 at 95.164.17.24:1224 (Stark, AS44477). Observed endpoints are /uploads (exfiltration), /pdown (payload download), /client/99 (returns the Python script main99.py), /payload/5346/root (InvisibleFerret backdoor) and /brow/5346/root (browser stealer).

The Python downloader sets sType='5346' and gType='root', points to http://95.164.17.24:1224, and stages payloads in a '.n2' directory under the user's home. It fetches variants for Windows, macOS (Darwin) and Linux. Intego additionally reports keylogging and installation of AnyDesk. The C2 had been active for more than a month before the 2024-07-15 publication, and a victim reported the lure on Reddit on 2024-06-11.

No CVE or CVSS applies: the threat relies on user execution of a trojanized installer. Severity is analyst-assigned. Note on hashes: the source page lists 9abf6b93... as the MiroTalk.dmg SHA-256 and 0F5F0A3A... as the Jami executable SHA-256; Intego lists 9abf6b93... plus two further hashes (10f86be3..., f08e88c7...) without stating file roles. Re-verify hashes against the published samples before blocking.

## MITRE ATT&CK

- T1566.003 Phishing: Spearphishing via Service
- T1204.002 User Execution: Malicious File
- T1059.006 Command and Scripting Interpreter: Python
- T1036 Masquerading
- T1555.001 Credentials from Password Stores: Keychain
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1056.001 Input Capture: Keylogging
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1571 Non-Standard Port
- T1219 Remote Access Tools
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BeaverTail macOS Qt Variant - Jami Binary Executed From Fake MiroTalk App Bundle** (`TL-2026-4892-SPL-001`)

Detects execution of the native Qt/C++ BeaverTail macOS stealer (MiroTalk.app/Contents/MacOS/Jami) from the trojanized MiroTalk.dmg used in the DPRK Contagious Interview campaign, either by bundle path, by launch from a mounted /Volumes disk image, or by a known SHA-256 from the Objective-See and Intego reporting. Execution of this unsigned, non-notarized binary is the point where browser, wallet-extension and keychain theft and the InvisibleFerret download begin. Note the source reports disagree on which hash belongs to the DMG and which to the Jami executable, so all published hashes are matched.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1036
- **Data sources:** crowdstrike_falcon:ProcessRollup2, macos_endpoint_process_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=edr sourcetype="CrowdStrike:Event:Streams:JSON" event_simpleName=ProcessRollup2 event_platform=Mac ```BeaverTail macOS Qt variant - Jami Mach-O inside fake MiroTalk.app or known-bad SHA256```
| where like(ImageFileName,"%/MiroTalk.app/Contents/MacOS/Jami") OR like(ImageFileName,"/Volumes/%/MiroTalk.app/%") OR SHA256HashData IN ("9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c","0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132","10f86be3e564f2e463e45420eb5f9fbdb14f7427eac665cd9cc7901efbc4cc59","f08e88c7397443e35697e145887af2683a83d2415ccd0c7536cea09e35da9ef7")
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentBaseFileName) as parent_process values(CommandLine) as command_line values(SHA256HashData) as sha256 by ComputerName UserName ImageFileName
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let known_bad_sha256 = dynamic(['9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c','0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132','10f86be3e564f2e463e45420eb5f9fbdb14f7427eac665cd9cc7901efbc4cc59','f08e88c7397443e35697e145887af2683a83d2415ccd0c7536cea09e35da9ef7']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath endswith '/MiroTalk.app/Contents/MacOS/Jami' or (FolderPath startswith '/Volumes/' and FolderPath contains '/MiroTalk.app/') or SHA256 in (known_bad_sha256)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: BeaverTail macOS Variant Executed From Fake MiroTalk App Bundle
id: 7c1e4a52-3b9d-4f60-8a17-2d5e9b0c6f31
status: experimental
description: Detects execution of the BeaverTail Qt/C++ Mach-O named Jami from a trojanized MiroTalk.app bundle or from a mounted disk image volume, as used by the DPRK Contagious Interview campaign.
references:
    - https://objective-see.org/blog/blog_0x7A.html
    - https://attack.mitre.org/software/S1246
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1036
logsource:
    category: process_creation
    product: macos
detection:
    selection_bundle:
        Image|endswith: '/MiroTalk.app/Contents/MacOS/Jami'
    selection_volume:
        Image|startswith: '/Volumes/'
        Image|contains: '/MiroTalk.app/'
    condition: 1 of selection_*
falsepositives:
    - Legitimate MiroTalk desktop client installed from the official vendor
level: high
```

**Known false positives:**

- Legitimate MiroTalk client installed from the official vendor site and run from a mounted volume
- Security researchers detonating the Objective-See published sample in a lab

**Tuning notes:** Replace index=edr and the CrowdStrike sourcetype with your macOS EDR index. Exclude lab hosts by ComputerName. Re-verify hashes against the published samples before relying on the hash clause, since sources disagree on which hash is the DMG and which is Jami. The path clause is the durable one if the binary is rebuilt.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Trojanized [indicator] Download From Cloned MiroTalk Site or Known-Bad Hash (locked: unlock with TL Creds)
- InvisibleFerret Python Downloader Staged in [indicator] or Running [indicator] (locked: unlock with TL Creds)
- Non-Browser Process Connecting To Public IP On TCP/1224 (BeaverTail C2 Port) (locked: unlock with TL Creds)
- BeaverTail Jami Binary Spawning Python or Shell Downloader (locked: unlock with TL Creds)
- AnyDesk Installed or Launched By Script and Python Keylogger Indicators (BeaverTail Follow-On) (locked: unlock with TL Creds)
- BeaverTail InvisibleFerret C2 HTTP Endpoints in Proxy Logs (locked: unlock with TL Creds)
- BeaverTail Credential and Wallet Extension Theft - Keychain and Browser Profile Access From Non-Browser Process (locked: unlock with TL Creds)
- BeaverTail InvisibleFerret C2 and Staging Infrastructure - Connections and DNS to Known and Community Indicators (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `95.164.17[.]24`
- Domain: `mirotalk[.]net`
- File hash: `9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [This Meeting Should Have Been an Email (Objective-See, Patrick Wardle)](https://objective-see.org/blog/blog_0x7A.html)
- [BeaverTail and InvisibleFerret malware target job-seeking Mac users (Intego)](https://intego.com/mac-security-blog/beavertail-and-invisibleferret-malware-target-job-seeking-mac-users)
- [MITRE ATT&CK: BeaverTail (S1246)](https://attack.mitre.org/software/S1246)
- [Bored BeaverTail, InvisibleFerret Yacht Club: A Lazarus Lure Pt 2 (eSentire TRU)](https://esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2)
- [N. Korean Hackers Use Fake Interviews to Infect Developers with Cross-Platform Malware (The Hacker News)](https://thehackernews.com/2024/10/n-korean-hackers-use-fake-interviews-to.html)
- [InvisibleFerret Malware: Technical Analysis (ANY.RUN)](https://any.run/cybersecurity-blog/invisibleferret-malware-analysis/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4892