Koi Stealer is an information-stealing family with Windows and macOS variants; a previously undocumented macOS build was used in a campaign targeting job-seeking cryptocurrency developers. Masquerading as a Visual Studio update, it repeatedly prompted for administrator credentials, collected the username, password, hardware UUID, and installed applications, then stole browser data, FileZilla and OpenVPN files, Steam and Discord data, Telegram files, SSH configurations, Keychains, Notes, documents, and cryptocurrency wallets. Koi encrypted and exfiltrated the material to command-and-control infrastructure and used AppleScript to mute the system while copying selected files.