RustBucket is a multistage macOS backdoor first reported in 2023 and associated with the North Korean actor tracked as Alluring Pisces. Initial AppleScript files delivered inside deceptive applications or archives retrieve a downloader disguised as a PDF viewer; that component then installs a Rust-based Mach-O payload. Later variants persist through a LaunchAgent, collect basic system information, receive a command-and-control location through the command line, and can download and execute files or terminate themselves. Recruiting-themed deployments have targeted finance personnel at cryptocurrency organizations.