The latest version also executes malicious code during the preinstall phase, and is bigger and faster than the first wave, say researchers.
The long-running Contagious Interview campaign is now hiding BeaverTail and InvisibleFerret payloads inside JSON storage services.