Kaspersky reported continued Lazarus Group operations against cryptocurrency businesses after Operation AppleJeus. The actor used fake companies and manipulated applications to gain trust, then delivered macOS and Windows malware through multi-stage infection chains. The macOS tooling included homemade malware and authenticated payload delivery designed to load later stages carefully, while the Windows path used a fake wallet updater and loader components. The report highlights Lazarus’ adaptation after earlier public reporting and its persistent focus on cryptocurrency-sector targets.