Kandji analyzed a macOS application named OSX-PDF-Viewer after VirusTotal detections labeled it as DPRK-attributed malware and researchers noted overlap with RustBucket artifacts. The app is an ad hoc-signed Swift PDF viewer based on an old open-source project and is meant to open a specific "Investment Opportunity - Fenbushi Capital.pdf" lure that tells the user to use a dedicated viewer. The analysis follows how the viewer restricts file selection to PDFs in the Downloads folder, verifies that the chosen PDF is the expected one, and extracts encrypted embedded content. Kandji treats the case as suspicious and possibly DPRK-related, but frames the work as reverse engineering to determine whether the file is malicious rather than as confirmed attribution.