North Korean hackers have adapted a spear-phishing campaign in order to infect devices running Apple’s MacOS, aiming to hit more victims and strengthen Pyongyang’s ability to steal cryptocurrencies, according to security researchers.

The cybersecurity firm ESET said Tuesday that the attackers linked to the DPRK’s Lazarus Group have updated the malware they use for the spear-phishing attacks targeting fintech workers.

In the campaign, North Korean hackers have distributed malware-laced PDFs disguised as job ads for Coinbase, one of the world’s largest cryptocurrency exchanges, Malwarebytes researcher Hossein Jazi previously concluded.