Daylight Security investigated a macOS intrusion attributed in the source to BlueNoroff, a financially motivated subgroup of North Korea’s Lazarus Group, and aligned it with the GhostCall campaign pattern. The attacker began with a Telegram business-prospect pretext, moved the victim to a Microsoft Teams call on a lookalike domain, and used audio-troubleshooting instructions to make the victim run terminal commands. The observed chain used native macOS tools including curl, chmod, codesign, nohup, and osascript to download and execute binaries from cache and temporary paths, stage data, and copy the user’s Keychain database. Infrastructure included teams.microscall[.]com, microsmeet[.]xyz, bluyy[.]com, supportzm[.]com, and Hostwinds IP addresses, showing how live social engineering can turn routine business workflows into credential-theft operations.