A Researcher from K7 Labs observed a new wave of fileless malware distributed by Lazarus APT Hackers Group to infects the MacOS users and delivers the fake cryptocurrency trading application.
Infamous Lazarus group involved various cyber-attack that GBHackers reported in the past, and its already targeted several financial organizations around the world using various advanced tools and techniques.
It is a rare scenario that the macOS malware goes fileless, and is a sign of APT’s are finding new methods to attack the mac world.
K7 labs observed the trojanized version of UnionCryptoTrader.dmg file, which is identified as a container of the Cryptocurrency trading application and a loader. 
Threat actors created a new malicious website (Union Cryto Trader),  unioncrypto.vip just for 1 year to deliver the fake cryptocurrency trading application and the site is resolving to .
Researchers believe that the campaign could have been active since June 2019, and its delivered the UnionCryptoTrader.dmg file had no digital signature.
Lazarus targeting the various Cryptocurrency trading application and this is one of the methods of trojanising a Mac application to steal the cryptocurrency.
Actors placed a persistent backdoor resource directory of an open-source trading application, and they are leveraging the post-install script to trigger their backdoor via a legitimate installation process.
Once the Shell script gets successfully executed, the loader collects Mac’s serial number and OS information and shares these data to the Lazarus via C&C server.
In response, attackers send the remote payload, which undergoes a base64 decode followed by AES decryption.
This attack indicates that macOS malware keeps evolving and becoming more sophisticated. 
You can also read the complete technical write about this Mac malware from objective-see by Patrick Wardle.
UnionCryptoTrader.dmg – Trojan ( 0001140e1 )
Hash: 2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390
New Mac Malware OSX/Linker Bypasses Zero-day Flaw in macOS Gatekeeper Protection
Mac Malware Steals Cookies & saved Passwords when Users Visiting Crypto Exchange Service Websites
fe-shopru tumblrcom