Malwarebytes analyzed a macOS variant of the Dacls RAT that it associates with Lazarus/Hidden Cobra/APT38 and detects as OSX-DaclsRAT. One observed variant downloaded a payload from loneeaglerecords[.]com into ~/Library/.mina, while related samples shared beaconing command codes with Linux.dacls. The Mac RAT established TLS communications using WolfSSL and encrypted data over SSL with RC4 generated from a hardcoded key. The added Socks plugin acted as a Socks4 proxy between the bot and C2 infrastructure and included a worm-scanning function for subnets on ports 8291 and 8292, showing continued cross-platform tool development.