Initial research exposing JOKERSPY

Elastic Security Labs details REF9134, an active intrusion targeting a major Japanese cryptocurrency exchange that leverages a self-signed macOS Swift binary (xcc/JokerSpy) to probe and bypass TCC permissions, deploys the Python backdoor sh.py to beacon to C2 and execute payloads, and runs the Swiftbelt enumeration tool; the report includes timeline, TTPs, IOCs (domains and SHA-256 hashes), and YARA detection rules.