North Korean hackers spread the "NimDoor" macOS malware targeting Crypto Assets companies through fake Zoom updates.

According to a report by The Block: SentinelLabs warns that North Korean hackers are using the NimDoor backdoor virus disguised as a Zoom update to attack macOS systems, stealing Wallet data and passwords.

Security firm SentinelLabs has warned in a recent research report that a North Korean hacking group is using a new macOS backdoor virus called NimDoor to infect Apple devices, thereby infiltrating cryptocurrency companies and stealing Wallet credentials and browser passwords.

The virus is hidden in a fake Zoom updater, primarily spreading through the Telegram social platform. The attackers used familiar social engineering tactics: first contacting target users via Telegram, then scheduling a "meeting" on Calendly to lure victims into downloading a malicious installation package disguised as a Zoom update. The software bypasses Apple's security detection mechanisms through a method known as "sideloading" and successfully runs on the device.

What makes NimDoor special is that it is written in a niche programming language called Nim, which is rarely used in malware, allowing it to evade Apple's current virus signature detection. Once installed, this backdoor will:

Collect passwords saved by the browser;

Stealing Telegram local database;

Extract encryption wallet file;

And create a login startup item to achieve persistent operation and download subsequent attack modules.

SentinelLabs recommends:

Encryption companies should prohibit all unsigned installation packages;

Only download Zoom updates from the official zoom.us website;

Review the Telegram contact list and be wary of unknown accounts that actively send executable files.

This attack is part of North Korea's ongoing campaign against the Web3 industry. Previously, Interchain Labs revealed that the Cosmos project team had inadvertently hired North Korean developers. At the same time, the U.S. Department of Justice also charged several North Korean suspects, alleging that they laundered over $900,000 worth of stolen encryption through Tornado Cash, with these individuals impersonating U.S. citizens and planning multiple cyberattacks.

According to the latest estimates from blockchain security company TRM Labs, hacker groups associated with North Korea have stolen over $1.6 billion in encryption assets in the first half of 2025. Among them, the Bybit attack incident in February alone caused a loss of $1.5 billion, accounting for more than 70% of all encryption losses in Web3 for the first half of the year.