North Korean hackers have MacOS users in their crosshairs, deploying a new variant of a malware family to take control of devices and steal personal data, as Pyongyang expands its cybercrime portfolio. 

The new variant of RustBucket, a malware family revealed by Apple device management company Jamf in April, is in an “active development” phase and adds built-in persistence techniques to avoid digital signature detection, U.S.-Dutch software company Elastic reported Thursday. 

Elastic Security Labs researchers attributed the campaign with “high confidence” to the Pyongyang-backed Lazarus Group’s BlueNoroff cluster.

Elastic noted