FlexibleFerret — Threat Actor Profile, Campaigns & Targets

Threat entity extracted from intelligence sources

Frequency
7
occurrences
First Seen
November 25, 2025
Last Seen
April 22, 2026

Related Threat Clusters

  • Void Dokkaebi's Malware Campaign Exploits Developer Repositories via Fake Job Interviews

    Void Dokkaebi, a North Korean threat actor, has escalated its malware distribution tactics by using fake job interviews to compromise software developers. This campaign, known as the 'Contagious Interview,' targets…

    22 articles · Updated April 22, 2026
  • Revamped FlexibleFerret Malware Chain Targets macOS Systems

    The North Korea-linked FlexibleFerret malware has been updated to enhance its stealth and persistence on macOS systems. The new attack chain includes a second-stage shell script that fetches payloads based on the system…

    2 articles · Updated November 26, 2025
  • New Malware Targets MacOS User Credentials

    A new malware strain attributed to the group FlexibleFerret has been discovered on macOS, specifically designed to steal user credentials. This malware employs multi-stage scripts and a Go-based backdoor to infiltrate…

    2 articles · Updated November 26, 2025
  • macOS Users Targeted by FlexibleFerret Malware via Terminal Command Scam

    A series of cyberattacks is targeting macOS users through deceptive job recruitment scams that trick victims into executing terminal commands. This method delivers the FlexibleFerret malware, compromising user systems.…

    3 articles · Updated November 26, 2025

Recent Intelligence Reports

  • 739165 — www.cybersecuritydive.com · April 22, 2026
  • Hackers Tricks macOS Users to Execute Command in Terminal to Deliver FlexibleFerret Malware — Cybersecuritynews · November 27, 2025
  • Updated FlexibleFerret malware chain against macOS uncovered — Scworld · November 26, 2025
  • A new malware for MacOS has been discovered that targets user credentials — En.Softonic · November 26, 2025
  • Hackers Exploit macOS Users With Terminal Command Scam to Deliver FlexibleFerret Malware — Cyberpress · November 26, 2025
  • Hackers Trick macOS Users into Running Terminal Commands to Install FlexibleFerret Malware — Gbhackers · November 26, 2025
  • New FlexibleFerret Malware Chain Targets macOS With Go Backdoor — Infosecurity-Magazine · November 25, 2025

CVSS v3.1 Breakdown