North Korean cybercriminals targeted blockchain engineers working for a cryptocurrency exchange platform with new macOS malware, posing as fellow engineers on an instant messaging platform, according to a U.S. cybersecurity firm.

Researchers traced the intrusion to a Python programming language application disguised as a tool designed to profit from cryptocurrency rate differences between various platforms, Elastic Security Labs said in a report published Wednesday.

Citing similarities in techniques, network infrastructure and certificates used to digitally sign applications, the firm attributed the attack to the DPRK’s Lazarus Group.

The campaign’s focus