RustDoor is Rust-based malware for macOS observed in a campaign targeting job-seeking software developers in the cryptocurrency sector. It masqueraded as a legitimate software update and appeared alongside a previously undocumented macOS variant of Koi Stealer. Researchers linked the surrounding social-engineering activity to characteristics reported for North Korea-associated threat actors and observed manipulation of macOS components for evasion. The investigation also found distinct command-and-control servers among analyzed samples and noted that a malware file named .zsh_env shared a hash with a previously reported ThiefBucket sample.