Kandji analyzed TodoSwift, a signed macOS Swift/SwiftUI dropper uploaded to VirusTotal on 2024-07-24 and assessed as likely related to DPRK-linked BlueNoroff activity because of overlap with KandyKorn and RustBucket tradecraft. The TodoTasks application presents a PDF lure to the user while its document window-controller path prepares two embedded URLs. One URL points to a Google Drive download, a technique previously observed in DPRK malware, and the other points to buy2x.com for a second-stage payload path. The report focuses on the dropper logic that hides malware execution behind a Bitcoin-themed PDF workflow rather than on a full intrusion chain.