SentinelLabs links the Hidden Risk campaign to DPRK BlueNoroff activity targeting cryptocurrency businesses on macOS. The campaign uses phishing emails with fake cryptocurrency news and a malicious application disguised as a PDF, including lures such as "Hidden Risk Behind New Surge of Bitcoin Price." The Swift first stage opens a decoy PDF from Google Drive, then retrieves an x86-64 Mach-O backdoor from actor controlled infrastructure such as matuaner[.]com. The malware abuses zshenv for persistence, a technique SentinelLabs highlights as novel in this activity and as part of the broader RustBucket, ThiefBucket, and KandyKorn lineage.