Poisoned Pipeline / Incidents / AS325
AppleJeus fake crypto trading apps carried malware from vendor-run sites
Windows softwaremacOS softwareInstaller / update channel
CISA/FBI/Treasury advisory AA21-048A (updated April 2021) describes
AppleJeus: since at least 2018, Lazarus Group has distributed fake
cryptocurrency trading applications built to look like products of
legitimate trading companies. The applications were hosted on websites
that appeared to belong to those companies and were also spread through
phishing, social networking and social engineering. Variants exist for
Windows and macOS; later ESET analysis reported Linux and macOS variants
and installer packages signed with certificates the operators obtained.
The objective was theft of cryptocurrency from exchanges and financial
services. This is a design-stage, attacker-owned-product case: the
software is not a trojanized version of a real vendor's build, it is a
convincing counterfeit of one.
Mapped techniques
supply-chain Fake trading application
The victim installs a counterfeit product from a site that looks
like the real vendor, not a poisoned version of a legitimate
dependency.
Later variants were signed with certificates the operators
acquired themselves, so Gatekeeper and Authenticode checks pass
on a product that has no legitimate vendor behind it.
Framework gaps noted
- The document lists this as a design-stage attack. In corpus terms it is a counterfeit product, not a compromise of a real supplier's build — which is why T0197 and T0215 carry it rather than a build-compromise technique.