Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →TodoSwift is a macOS dropper reported in August 2024. Its signed application, named TodoTasks, showed users a cryptocurrency-themed PDF while downloading and executing another payload. Researchers linked its behavior to malware associated with BlueNoroff, a North Korean-linked hacking group, but the public evidence supports a qualified assessment—not definitive proof of who operated this sample. No reliable victim count or confirmed victim geography has been reported.
What is TodoSwift?
TodoSwift is the name used in 2024 reporting for a Swift and SwiftUI macOS dropper. The reported application was named TodoTasks; that name does not make it a legitimate task-management app. Kandji’s account and IRU’s technical write-up describe the application as using a cryptocurrency-related PDF as a decoy while arranging retrieval and execution of a second-stage payload. The Hacker News report and IRU’s analysis provide the August 2024 account.
How does the TodoSwift Mac malware work?
- It runs as a signed application. Reporting identifies the dropper as TodoTasks, built with Swift and SwiftUI.
- It presents a decoy document. The application displays a PDF with cryptocurrency-related content, making the visible activity appear relevant to that subject.
- It retrieves and executes another payload. The PDF is part of the cover story; the application also downloads and runs a second-stage component.
Objective-See’s annual Mac Malware of 2024 report characterizes the examined TodoSwift downloader as non-persistent. That description applies to the downloader discussed in the report; it does not establish that every related sample or any second-stage payload lacks persistence.
Why was TodoSwift linked to North Korean hacking groups?
The linkage rests on similarities between TodoSwift’s behavior and malware associated with BlueNoroff, particularly KANDYKORN and RustBucket. Kandji security researcher Christopher Lopez said: “This application shares several behaviors with malware we’ve seen that originated in North Korea (DPRK) — specifically the threat actor known as BlueNoroff — such as KANDYKORN and RustBucket.”
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
That is a researcher’s assessment based on behavioral overlap. It is not public proof that BlueNoroff operated this particular sample, nor an attribution finding by a government authority or court. The careful conclusion is that researchers linked TodoSwift to BlueNoroff-associated malware; the available reporting does not establish its operator with certainty. Kandji’s assessment, as reported by The Hacker News, and IRU’s account describe the similarities.
What is known about TodoSwift’s victims?
The reviewed reports do not establish a reliable number of infections, an estimate of prevalence, or a confirmed victim geography. The existence of a described sample and its execution chain should not be mistaken for evidence about how widely it spread or who was affected.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Is TodoSwift related to the macOS activity reported in 2026?
No such relationship is established in the available reporting. In April 2026, Microsoft Threat Intelligence and the Microsoft Defender Security Research Team reported on separate macOS intrusions attributed to Sapphire Sleet, with the report updated to include June 2026 activity. That account describes social engineering, fake update lures, user-run AppleScript or Terminal commands, and credential theft. It does not report TodoSwift or show that TodoSwift remained active, shared the same delivery chain, or was operated by Sapphire Sleet. Microsoft’s practical guidance includes caution around unsolicited job-related software requests, scrutiny of scripts and commands, and keeping protections current. Read Microsoft’s separate Sapphire Sleet report.
Quick Recap
Best Value
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Rank #4
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
