DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads

It begins with a Discord user downloading a malicious Python application, Cross-Platform Bridges.zip. Initially, links to the malware were sent to targets via direct message with the malware hosted on Google Drive.