CISA, the FBI, and the U.S. Treasury attributed the Kupay Wallet AppleJeus operation to North Korea's Lazarus Group, which used a legitimate-looking cryptocurrency wallet to target individuals and financial-sector organizations. Windows and macOS installers deployed updater components that established persistence and contacted kupaywallet.com to obtain additional payloads. The analyzed macOS second stage used levelframeblog.com for command and control and supported payload transfer, file operations, and terminal command execution with Base64 and XOR encoding.