Kaspersky analyzed a new macOS loader likely linked to BlueNoroff's RustBucket campaign against cryptocurrency and financial targets. The ZIP archive contained a fake PDF theme, "Crypto-assets and their risks for financial stability," and a signed Swift app named EdoneViewer that decrypted an AppleScript payload. The script opened a benign PDF as a decoy, posted to the C2 server, saved a hidden /Users/Shared/.pw payload, and executed it with the C2 address as an argument. The .pw Trojan collected startup time, OS installation date, and running process data every minute, then waited for commands to execute a downloaded file, delete itself, or keep polling.