A piece of macOS malware masquerading as a Visual Studio update has been giving back door access to infected systems. Beginning in November 2023, the campaign uses a rust-based malware which Bitdefender has named “RustDoor” and is capable of running on both Intel-based and Apple ARM CPU architectures. Once the back doors are created, the infected systems have been seen connecting to command-and-control (C2) infrastructure associated with the ALPHV/BlackCat threat actor group. There are four (4) known C2 servers, three (3) of which have previous connections to ALPHV ransomware operators. RustDoor is distributed to systems disguised as a Visual Studio updater for macOS which is delivered in binaries that includes the malware for both the x86-64 and ARM architectures. RustDoor contains a multitude of commands that can be used to instigate additional processes and the infiltration/exfiltration of data. Other capabilities include the ability to alter the file structure of an infected system, display phishing messages to users, and bring in more malware payloads. Additionally, RustDoor edits the “~/.zshrc” file which is used to execute RustDoor in a new terminal to help prevent detection by typical antivirus tools. CTIX analysts will continue to monitor the situation of macOS based malware and its impact on the macOS ecosystem.