Scworld

Revamped FlexibleFerret Malware Chain Targets macOS Systems

First seen 26 Nov 2025, 19:33 UTC • Infosecurity-Magazine

•84% similarity •39.0

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The North Korea-linked FlexibleFerret malware has been updated to enhance its stealth and persistence on macOS systems. The new attack chain includes a second-stage shell script that fetches payloads based on the system architecture and utilizes a Go-based backdoor to maintain long-term access while bypassing user safeguards.

ThreatCluster AI How this analysis works

Attack Flow

10 entities, 10 inferred relationships (STIX 2.1).

Threat Actor (1)

FlexibleFerret

Technique (4)

Malware
Launch Agent
T1059 - Command and Scripting Interpreter
T1547.001 - Launch Agent

Campaign (1)

Contagious Interview

Indicator (1)

api.ipify.org

Malware (1)

CDrivers

Affected Platform (1)

MacOS

Tool (1)

Dropbox

Relationships

FlexibleFerret uses CDrivers
FlexibleFerret uses Dropbox
FlexibleFerret uses Malware
FlexibleFerret uses Launch Agent
FlexibleFerret uses T1059 - Command and Scripting Interpreter
FlexibleFerret uses T1547.001 - Launch Agent
CDrivers communicates with api.ipify.org
Contagious Interview attributed to FlexibleFerret
Contagious Interview uses CDrivers
FlexibleFerret related to MacOS

Community

Browse all →

Tracked Entities in This Story

FlexibleFerret CDrivers Contagious Interview MacOS

Revamped FlexibleFerret Malware Chain Targets macOS Systems

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story