SentinelOne's macOS malware review highlights DPRK-linked activity against job seekers and cryptocurrency targets during 2024. The BeaverTail section describes North Korean operators impersonating recruiters on LinkedIn, X, and Freelancer, then pushing trojanized MiroTalk or FreeConference applications that steal browser credentials, target cryptocurrency wallet extensions, and can deploy InvisibleFerret for keylogging, file theft, and remote-control tooling. The ToDoSwift and Hidden Risk sections describe BlueNoroff-attributed crypto lures, including signed macOS applications that display decoy Bitcoin or crypto news PDFs while downloading second-stage backdoors from actor-controlled domains such as buy2x[.]com and matuaner[.]com. The report ties these cases to broader Contagious Interview, Operation In(ter)ception, and Operation Dream Job tradecraft.