Well-known North Korean attackers have launched a new social engineering campaign against cryptocurrency users with the end goal of deploying the “AppleJeus” malware. The Lazarus Group, tracked alternatively as APT38, is one of the more notorious threat groups aligned with North Korea. Lazarus focuses on financial cybercrime in an effort to relieve financial strain from strict sanctions imposed on North Korea by opposing countries. In this new campaign, Lazarus actors are conducting spear-phishing attacks against cryptocurrency users and affiliate organizations. The first instance of this campaign included Lazarus actors cloning a popular crypto-scripting application site that cryptocurrency users leverage to automate trading algorithms. When downloaded from the cloned site, a malicious MSI installer is trojanized with the AppleJeus malware. Furthermore, Lazarus actors incorporated the QTBitcoinTransfer application (previously used by the threat group) within the malicious code. The following wave included threat actors distributing phishing emails containing malicious Microsoft Office documents to victims. Once opened and permissions are enabled, embedded macro code deploys malware onto the victim’s system, resulting in the successful infection of victim’s system with the AppleJeus malware. CTIX continues to urge users to validate the integrity of all email communications prior to downloading any attachments or visiting any embedded links to lessen the risk of threat actor compromise.