TodoSwift: North Korean Cybercriminals Use Bitcoin Lure to Spread macOS Malware

### Executive summary: The report describes TodoSwift, a signed macOS dropper discovered on VirusTotal that poses as a Bitcoin PDF to lure users while silently downloading and launching a second-stage payload via Google Drive; analysis links the sample to DPRK-aligned BlueNoroff and highlights its Swift/SwiftUI GUI, use of Google Drive for payload delivery, and C2 passed as a launch argument, with stage-2 capabilities still under investigation.