One of the most prolific hacking groups linked to North Korea appears to be targeting Apple users with new malware previously only found on Windows and Linux, researchers warned Wednesday.

Security firm Malwarebytes Labs discovered the variant in a MacOS application used to generate temporary access codes for Two-Factor-Authentication, the company explained in a report. 

The application called “MinaOTP,” which the researchers attributed to the Lazarus Group, seemed to be targeting victims in China and contained code that allowed attackers to gain control of the infected computer.

Once in control, attackers are able to launch additional software as