North Korea's fake-job malware: four reasons my antivirus stayed silent

In short: I was hit twice by fake Upwork jobs, and my antivirus said nothing either time. The sources give four reasons it had nothing to object to: I ran the code myself, so the Mac's checks stepped aside; it used trusted tools like node, curl and bash; the variants were new, so the signatures came later; and a stolen login session can get past 2FA. The fix the sources point to: treat every install as code, be wary of anyone asking you to run a terminal command, and check what code does before it first runs.

Silent, twice

This is my own story; I wrote up both run-ins in Two fake Upwork jobs, one infected Mac. The part that bothered me most: "neither macOS's built-in XProtect nor traditional antivirus made a sound, either time."

That isn't the same as antivirus being useless. The sources below say it lags and gets stepped around, not that it's worthless.

1. I ran it myself

Microsoft Threat Intelligence describes a macOS campaign by the North Korean actor Sapphire Sleet "that relies on social engineering rather than software vulnerabilities."

In Microsoft's words: "By persuading users to manually execute AppleScript or Terminal‑based commands, Sapphire Sleet shifts execution into a user‑initiated context, allowing the activity to proceed outside of macOS protections such as Transparency, Consent, and Control (TCC), Gatekeeper, quarantine enforcement, and notarization checks."

2. Trusted tools

Microsoft again: "This activity demonstrates how threat actors continue to rely on user interaction and trusted system utilities to bypass macOS platform security protections, rather than exploiting traditional software vulnerabilities."

That matches what I saw: "These attacks come in new packaging every time and use the most ordinary tools there are, like node, curl and bash, so traditional antivirus has no reason to find them suspicious."

3. New, so no signature

Signatures do come, once a campaign is known: Microsoft notes that "Apple has also deployed XProtect signatures to detect and block the malware families associated with this campaign—macOS devices receive these signature updates automatically."

But new variants can be missed when they're found. SentinelOne, in early 2025, reported "newly discovered samples that we have labelled 'FlexibleFerret' and which remain undetected by XProtect at the time of writing."

Taking packages down doesn't end it either. Socket: "Since our July 14, 2025 update, we have identified and analyzed more than 338 malicious packages with over 50,000 cumulative downloads." And: "We continue to see weekly upload bursts, rapid re-uploads after takedowns, and iterative changes to loaders and postinstall scripts."

4. A stolen session skips 2FA

Microsoft, writing about phishing in 2022: "Once the attacker obtains the session cookie, they can inject it into their browser to skip the authentication process, even if the target's MFA is enabled."

At Bybit, according to the FBI, "North Korea was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit". Safe{Wallet}, quoted by The Hacker News: "The attack involved the compromise of a Safe{Wallet} developer's laptop ('Developer1') and the hijacking of AWS session tokens to bypass multi-factor authentication ('MFA') controls."

Even experts fall for it

The FBI: "Given the scale and persistence of this malicious activity, even those well versed in cybersecurity practices can be vulnerable to North Korea's determination to compromise networks connected to cryptocurrency assets."

The fix

1. Check what code does before it first runs, not what it's called. That's my takeaway from both run-ins.
2. Every install is code. Socket: "Treat every npm install as code execution and block risky behavior before it reaches developer machines or pipelines."
3. Never paste a stranger's command. Microsoft advises: "Educate users about social engineering threats originating from social media and external platforms, particularly unsolicited outreach requesting software downloads, virtual meeting tool installations, or execution of terminal commands."

After my two run-ins I built Tsuba, a free Mac app with one idea: "before unfamiliar code runs for the first time, it takes a look for you."

Sources

• Oliver Zhang, Two fake Upwork jobs, one infected Mac, 28 Oct 2026
• Microsoft Threat Intelligence, Dissecting Sapphire Sleet's macOS intrusion from lure to compromise, 16 Apr 2026
• SentinelOne, macOS FlexibleFerret: Further Variants of DPRK Malware Family Unearthed, updated 2 Sep 2025
• Socket, North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads, 10 Oct 2025
• Microsoft, From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud, 12 Jul 2022
• The Hacker News, Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist, 7 Mar 2025
• FBI, PSA 250226 (Bybit), 26 Feb 2025
• FBI, PSA 240903: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks, 3 Sep 2024

The video is animated with code and the script was written with AI assistance; every quote above is checked against the sources. Illustrative: the "no threats" shield, the gates swinging aside, the scanner and its X-ray, the signature timeline and the session cookie. This post explains the risk and the fix, not how the malware works. Made with Shotloop, my free Mac app for code-made explainers, fixed one shot at a time.