North Korean Hackers Deploy RustDoor and Koi Stealer to Target Cryptocurrency Developers on macOS

Unit 42 describes a macOS-focused campaign named CL-STA-240 ("Contagious Interview") that lures developers with fake job interviews and installs RustDoor and a macOS Koi Stealer variant to gain persistence, exfiltrate cryptocurrency wallets and credentials (including LastPass/Keychain data), and communicate with attacker C2 (notably IP 31.41.244.92); researchers link the TTPs with DPRK-associated groups such as BlueNoroff/Lazarus.