Attributed to the BlueNoroff APT group, JokerSpy was first spotted targeting a cryptocurrency exchange in Japan. The malware employs a variety of backdoors to deploy spyware on compromised systems and uses open-source tools for reconnaissance. Its Python-scripted backdoors enable dynamic configuration loading and command execution, allowing for a diverse set of malicious actions. In addition to evaluating system permissions, JokerSpy is known to abuse TCC (Transparency, Consent, and Control). It may also deploy SwiftBelt, an open-source macOS post-exploitation toolset commonly used in red teaming exercises.