Hidden Risk is a 2024 BlueNoroff campaign targeting cryptocurrency and decentralized-finance organizations and users on macOS. Operators sent phishing emails with fabricated cryptocurrency news and delivered signed malicious Swift applications disguised as PDF documents; execution displayed a decoy from a trusted cloud service while retrieving a backdoor for remote access. The campaign used the shell environment configuration file for persistence, avoiding the background-item notifications introduced in newer macOS versions, and marked a shift from prolonged social-media grooming toward simpler, direct phishing lures.