SentinelOne links two 2023 DPRK-aligned macOS campaigns, RustBucket and KandyKorn, and reports that SwiftLoader droppers are being reused to deliver KandyKorn payloads. RustBucket used PDF viewer lures and SwiftLoader to fetch later-stage Rust malware, while KandyKorn targeted blockchain engineers through Discord social engineering and a fake cryptocurrency arbitrage bot. The observed chain includes Python scripts, SUGARLOADER, HLOADER persistence inside the Discord app bundle, configuration retrieval from com.apple.safari.ck, and in-memory execution of the KANDYKORN RAT over C2 infrastructure such as tp-globa.xyz and 23.254.226.90.