North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught

TA444, a North Korean state-backed APT, debuted a new macOS backdoor named SpectralBlur in August. Proofpoint analysis shows SpectralBlur provides post-exploitation capabilities (file transfer, remote shell, config updates, file deletion) and shares code/strings with other macOS malware like KandyKorn, linking it to phishing campaigns and underscoring an embedded malware development capability within TA444 targeting macOS users, including cryptocurrency-related targets.