K7 Labs analyzed a Lazarus Operation In(ter)ception macOS sample that used a revoked signed fat binary to target users with a Coinbase job-vacancy lure. The malware drops a Coinbase-themed PDF, FinderFontsUpdater.app, a downloader named safarifontsagent, and a zero-byte Finder file under ~/Library/Fonts, then persists via a LaunchAgent named iTunes_trush. The safarifontsagent component gathers host details such as macOS version and CPU information and appends them to requests to the defanged C2 hxxps(:)//concrecapital(.)com. The C2 was unavailable during analysis, but K7 identified the parent malware hash 4a7a1626b6baf8c917945b8fc414c8b9 and documented the staged download flow used to retrieve the next payload.