Kaspersky describes Operation AppleJeus, a Lazarus campaign that targeted a cryptocurrency exchange through a trojanized Celas Trade Pro cryptocurrency trading application. The victim installed the application from a legitimate-looking website after receiving a download link by email, and the Windows installer launched a signed Updater.exe that collected host and process information before contacting www.celasllc[.]com/checkupdate.php. The updater disguised encrypted data transfer as GIF-like upload content, used hardcoded XOR and RC4 keys, and downloaded an additional payload when the server returned HTTP 200. The operation also included a macOS version with a hidden autoupdater launched through a dot-prefixed plist, making this notable as one of the first observed Lazarus malware operations against macOS. The report matters because it shows Lazarus using supply-chain-style software trojanization against cryptocurrency targets and expanding beyond Windows-only tooling.