Trend Micro describes a Lazarus-attributed macOS NUKESPED campaign targeting Korean users through a macro-enabled Excel lure and a separate malicious Flash Player app bundle. The macro contacted crabbedly[.]club, craypot[.]live, and indagator[.]club, while the Mac bundle ran a decoy Flash Player, dropped a hidden Backdoor.MacOS.NUKESPED.A file, and installed persistence with ~/Library/LaunchAgents/com.adobe.macromedia.plist. The backdoor used command-driven C2 functions such as host information collection and configuration updates, showing Lazarus moving from cross-platform macro delivery toward more OS-specific macOS tradecraft.