North Korean threat actors are described as testing or deploying macOS malware embedded in Flutter applications, including a Minesweeper-themed lure named "New Updates in Crypto Exchange (2024-08-28)." The malware uses Dart payloads, compromised Apple developer IDs, and a C2 at mbupdate.linkpc.net to process reversed AppleScript commands. Variants written in Golang and Python show the operators experimenting with multiple runtimes to obscure activity. The source says attribution to a specific group is not confirmed, but infrastructure overlaps suggest possible links to BlueNoroff and cryptocurrency-focused social engineering.