Last week’s reporting covered DPRK activity against developers, software supply chains, and remote hiring. Genians found Kimsuky infrastructure running local AI tools and document retrieval software. CrowdStrike attributed the poisoning of 131 AI framework packages to STARDUST CHOLLIMA, while an investigation into North Korean command-and-control servers found evidence of intrusions at hundreds of organizations.

Researchers also placed DPRK-linked IT workers inside a controlled DeFi company and recorded their remote-access tools, VPN use, job-application services, and account synchronization. AhnLab connected current Xctdoor distribution with older CRAT operations attributed by other firms to Lazarus, though the current campaign was not directly attributed on that basis. Reports on device surveillance and smishing inside North Korea concerned domestic control and crime rather than an external state-directed campaign.

Key Trends

1. Kimsuky adds AI tools to established attack methods

Genians linked Operation GitPower to Kimsuky through linguistic artifacts, overlap with earlier campaigns, and infrastructure behavior. The operation uses spearphishing, malicious LNK files, obfuscated PowerShell, scheduled tasks, and Git repositories to collect system information and deliver encrypted AsyncRAT payloads.¹²

Logs from the infrastructure recorded Ollama, GPT4All, and Msty installations. The operators also configured document-based retrieval augmented generation and collected libraries for AI agents, external model integration, and speech-to-text processing. The evidence points to work with existing models, not the training of a proprietary model. Plausible uses include preparing lures, analyzing stolen data, and assisting malware development, but the observed installations do not establish how extensively the tools were used in live operations.

2. Developers remain both an access route and a supply-chain target

Researcher Vangelis Stykas told Wired that 22 months of access to North Korean command-and-control servers exposed evidence affecting 1,640 companies in 57 countries. He assessed that 700 to 800 organizations suffered serious intrusions involving root access to servers, AWS environments, or cryptocurrency wallets. Much of the activity relied on Contagious Interview, which uses fake job offers and malicious coding tests, as well as fraudulent remote employment by North Korean IT workers.³

CrowdStrike separately attributed the poisoning of 131 AI framework packages to STARDUST CHOLLIMA. The package campaign sought access through components trusted by developers, creating a route into downstream systems. These reports describe distinct operations, but both exploit routine developer work: evaluating code from a recruiter and importing software into a project.⁴

3. A controlled workplace exposed IT worker tradecraft

BCA LTD, NorthScan, and ANY.RUN recruited operators they identified as DPRK-linked Famous Chollima IT workers into a simulated DeFi company. Monitored Windows sandboxes recorded screen activity, files, and network requests. The workers used AnyDesk and Chrome Remote Desktop, Astrill VPN, one-time-password services, synchronized Google accounts, and automated job-application tools.⁵

The researchers observed four Astrill VPN nodes and a residential address in Vladivostok. They connected the latter through an associated individual and logistics company to prior reporting on North Korean connectivity and IT worker activity. That association is an investigative lead rather than proof of each operator’s physical location. The presentation also traced clusters of similar company websites, suspected shell-company arrangements, and cryptocurrency services used to move earnings.

4. Xctdoor activity overlaps with older CRAT operations

AhnLab connected Larva-26005’s recent Xctdoor distribution to CRAT attacks against South Korean users dating to 2020. Shared AppX installation paths, runtime code obfuscation, and the earlier deployment of CRAT, Xctdoor, and Hansom ransomware on the same systems support the connection. Other security firms attributed the older CRAT activity to Lazarus, so the finding does not amount to a new direct attribution of the current campaign.⁶⁷

The 2026 activity delivered C++ and Go variants of Xctdoor through fake Veraport and SoftCamp installers and malicious LNK files. Related activity abused compromised IIS servers, groupware upload pages, ERP update components, and a trojanized BeeBEEP installer. Xctdoor can run shell commands, transfer files, capture keystrokes and screenshots, monitor the clipboard, and inject payloads into memory.

5. Domestic surveillance and fraud require separate treatment

A DEF CON presentation described controls built into North Korean Android devices. TraceViewer captures a screenshot every five minutes, while RedFlag deletes transferred files that lack an approved cryptographic signature. State-run distribution points, network isolation, radio detection, device searches, and physical punishment reinforce these technical restrictions. The Pigeon tool counters one part of the system by self-signing media so it can pass RedFlag checks.⁸

Daily NK separately reported the arrest of two state-trained IT specialists accused of stealing from North Korean donju through smishing and voice phishing. The suspects allegedly impersonated the central bank and inspection agencies, stole Jonsong payment credentials, and used family information in extortion calls. The case describes domestic criminal use of state-developed skills. It does not establish direction by a DPRK external cyber unit.⁹

What to Watch

Development teams should isolate coding tests from unknown recruiters and review newly introduced packages before they reach build systems. Remote-hiring checks should compare identity documents, access location, payment ownership, interview behavior, and remote-control software. Account synchronization on managed workstations deserves attention because it can expose credentials and browsing data beyond the immediate session.

Endpoint monitoring should flag malicious LNK execution, unexpected scheduled tasks, fake enterprise-software installers, and payload retrieval from public code repositories. South Korean organizations using Veraport, SoftCamp, groupware, or ERP update components should also check for unauthorized installers and abnormal child processes.

Reports Reviewed

Last week’s DPRK-related reporting focused on open-source compromise, blockchain-based command delivery, and attacks through trusted South Korean websites and security software. Supply-chain campaigns first compromised developers or maintainers, then pushed malicious code into legitimate npm packages and Go modules. Separate research documented APT37’s NarwhalRAT infrastructure and an AFX bridge theft attributed in a detailed post-mortem to UNC4899 / TraderTraitor.

The package and watering-hole reports exposed recurring reliance on trusted access. Developers imported poisoned components, website visitors loaded vulnerable security software, and a DeFi developer cloned a repository offered through a fake job approach. IT worker alerts treated remote employment as both a sanctions-evasion channel and an insider risk.

Key Trends

1. Automated compromise spread through npm and Go

PolinRider poisoned packages and Go modules after compromising developer systems, apparently spreading to projects the victims could access rather than selecting only high-value targets. Twenty analyzed packages shared XOR keys, TRON wallets, a fake font loader, and an automated propagation script. Attackers backdated malicious Go commits, and deleted modules remained available through Go’s permanent proxy cache.¹

Two Joyfill beta packages ran an obfuscated loader when imported, not during installation. The chain followed transactions across Tron, Aptos, and BNB Smart Chain, then delivered a DEV#POPPER-style RAT and credential stealer. The code and protocol overlapped with PolinRider, but the three research teams did not uniformly attribute the Joyfill compromise itself.²³⁴

Amazon attributed several npm compromises, including Axios, to a DPRK-linked actor with medium confidence. Google’s mitigation guidance recommended release cooldowns, private registries, disabled lifecycle scripts, ephemeral CI runners, short-lived credentials, provenance checks, and strict outbound controls.⁵⁶

2. Blockchain records carried changing C2 information

A ClickFix operation used a fake macOS update page to make victims paste a Node.js command into Terminal. The implant read rotating C2 details from Ethereum contracts, collected wallet, browser, developer, and cloud credentials, and installed a malicious Chrome extension. Wallet and infrastructure links matched DPRK-linked UNC5342 and Contagious Interview activity.⁷

NullReceiver removed the smart contract. Trojanized npm packages looked up the attacker’s latest zero-value Ethereum transfer and decoded an IP address from the recipient address. This reduced the fixed transaction features defenders could fingerprint. Joyfill’s loader likewise walked transactions on several chains to find later stages.⁸²³⁴

3. APT37 paired spearphishing with cloud dead drops

WhoisXML API analyzed an APT37 campaign that delivered the Python-based NarwhalRAT through spearphishing and malicious LNK files. The RAT supported keylogging, screen capture, USB collection, and remote command execution. Its operators used a South Korean relay server and the pCloud API as a dead-drop resolver.⁹

Infrastructure expansion from five domains and six IP addresses produced 888 connected artifacts, but the researchers said those additional domains had not been weaponized. They are investigative leads, not confirmed campaign infrastructure.

4. Trusted websites and security software delivered backdoors

South Korean investigations described compromised websites that exploited vulnerable electronic-signature, authentication, and keyboard-security components. The chains installed DLL backdoors or memory-resident RATs without requiring the user to launch a file, then used credential dumping, RDP movement, reverse SSH tunnels, and anti-forensic tools.^10111213

SIGNBT variants supported discovery, commands, file and process control, screenshots, and in-memory modules. COPPERHEDGE variants hid data in the registry or NTFS alternate data streams and used encrypted web traffic for control.¹¹¹³

Operation Double Barrel found overlap between state-backed activity and Gunra ransomware in initial-access vulnerabilities, malware characteristics, SSH keys, and tunneling infrastructure. The English and Korean reports allowed for limited cooperation or shared resources but did not establish a firm relationship between the operators.¹⁴¹⁵

5. A fake job repository led to the AFX bridge theft

An early incident account described five compromised validator signatures authorizing a fraudulent withdrawal of about $24.15 million in USDC from the AFX bridge. The assets were moved to Ethereum, exchanged for ETH, and fragmented across many addresses. zeroShadow and SEAL assessed a highly likely link to UNC4899 from funding patterns, while describing the attribution as preliminary.¹⁶

AFX’s later post-mortem attributed the theft to UNC4899 / TraderTraitor. A developer cloned a malicious DEX repository offered through a fake job approach, triggering a modified Git post-checkout hook. The attacker persisted in JFrog through a malicious Groovy plugin and modified system components, recovered credentials, reached validator infrastructure through an operations bastion, and obtained the signatures needed for the unauthorized transaction. AFX found no compromise of Arbitrum or its native bridge.¹⁷

6. IT worker warnings moved from revenue to insider access

A South Korean joint alert warned that DPRK IT workers use forged identities, third-country facilitators, laptop farms, VPNs, and remote desktop tools to obtain jobs and conceal their location.¹⁸ A parallel international alert added that facilitators may attend interviews, supply payment accounts, and operate remote machines. Both treated data theft, cryptocurrency theft, and access to sensitive systems as risks alongside salary diversion.¹⁹

Other reporting described AI as an aid to identity fraud, lure preparation, and analysis rather than an autonomous attack capability.²⁰ A broader Lazarus overview traced cryptocurrency theft through attacks on employees, signing authority, wallet providers, and development environments, followed by swaps, wallet fragmentation, chain hopping, and mixers.²¹

Hato Tsusin was assessed as part of a DPRK-linked commercial network procuring RF, navigation, sensor, and communications components.²² A newly surfaced SiliVaccine version had replaced the Trend Micro engine found in an older sample with ClamAV signatures and Malheur-based clustering.²³

What to Watch

Development teams should inspect code that runs on package import as well as install hooks. After removing an affected package, rebuild compromised environments and rotate developer, cloud, and cryptocurrency credentials. Treat repositories delivered through recruitment contacts as untrusted even when the project appears functional.

South Korean website operators should monitor site integrity and patch third-party client security components. Hiring teams should compare identity, access location, payment ownership, video behavior, remote-control software, and account-use patterns before granting internal access.

Reports Reviewed

Fake meetings and job interviews drove several DPRK-linked operations last week. BlueNoroff, Sapphire Sleet, and Famous Chollima used compromised contacts or recruiter personas to direct targets to imitation meeting pages, then persuaded Windows and macOS users to execute commands. The resulting malware targeted browser credentials, cryptocurrency wallets, and remote control of the host.

Kimsuky reporting covered compromise at a South Korean groupware developer and movement into customer environments. Related presentations added victim counts and contrasted spearphishing with watering-hole exploitation. IT worker reporting followed both the hiring risk and the flow of salaries into a centralized state-linked payment system. An initial AFX account documented a bridge theft through developer compromise without making the later, more specific attribution published the following week.

Key Trends

1. Fake meetings turned trusted conversations into execution

JUMPSEC documented a BlueNoroff platform that used stolen Telegram accounts to approach cryptocurrency targets, profile their browsers, relay webcam feeds, and present fake Zoom or Teams meetings. Windows targets received a VBScript implant identified as NukeSped, while the macOS chain used a fake installer to conceal a Mach-O stealer.¹²

The ORO intrusion also began with a compromised Telegram contact and a fake Teams meeting. After an employee ran AppleScript, the attacker installed a browser extension and persistent implant, then stole the wallet controlling Bittensor SN15 and sold 147,000 Alpha Tokens. ORO attributed the operation to Sapphire Sleet from infrastructure and payload overlap with Microsoft reporting.³

Famous Chollima used fake cryptocurrency and Web3 interviews to deliver PylangGhost on Windows and GolangGhost plus a SwiftUI credential stealer on macOS. Invitation gating, browser fingerprinting, countdown pressure, and camera-error prompts increased pressure while limiting casual inspection.⁴

2. Groupware compromise reached downstream customers

ENKI reported that Kimsuky exploited a mail-server vulnerability at a South Korean groupware developer and likely used spearphishing in some cases. The attackers stole internal data and credentials, modified a login page to capture customer credentials, and deployed BirdTroy and DriveTroy. The Go-based backdoors used HTTP/3 and Google Drive for command and control.⁵⁶

A conference presentation on the same activity added that at least four customers were compromised through one vendor’s product and five more victim servers were identified through infrastructure tracking. It also documented Gomir, HttpTroy, HelloDoor, reverse proxying, and movement into deployment and development systems.⁷

3. LNK files and watering holes covered different access paths

Kimsuky lures impersonating diplomatic personnel used malicious LNK files to install PebbleDash and PrxClient, create persistence, and relay traffic to RDP.⁸ AhnLab’s English and Korean June reviews documented broader work-themed LNK and spearphishing chains using PowerShell, AutoIt, HTA, scheduled tasks, DLL side-loading, and Python.⁹¹⁰ A game-character design lure followed a similar shortcut-to-script pattern and ended with MoonPeak, a XenoRAT-based implant.¹¹

A separate presentation contrasted targeted spearphishing with watering holes that exploit vulnerable South Korean Non-ActiveX security software. The demonstrated chains used public cloud and code-hosting services during delivery and control, then performed discovery, anti-analysis checks, in-memory execution, and remote command handling.¹²

4. IT worker operations combined access and revenue

Remote workers used stolen or fabricated identities, AI-generated application material, manipulated video, and laptop farms to enter Western companies. Reported outcomes included malware installation after onboarding, source-code theft, extortion, and possible supply-chain access.¹³

Records from an exposed DPRK payment server contained 390 accounts, chats, and cryptocurrency transactions. Workers sent salary payments through luckyguys.site to an administrator account, after which funds were pooled through structures associated with Unit 1020, Command 710, and a wallet assessed as likely tied to sanctioned Korea Ryonbong General Corporation.¹⁴

5. Cryptocurrency theft and naming changes needed careful context

AFX’s first incident account said a malicious repository shared over Telegram compromised a developer, after which the attacker persisted in JFrog and moved toward validator infrastructure. A remote payload enabled unauthorized access to the custody bridge. The report said neither Arbitrum nor its native bridge was compromised and did not yet make the UNC4899 attribution that appeared in the following week’s detailed post-mortem.¹⁵

Daily NK’s account of former military intelligence personnel stealing from North Korean banks described domestic crime using state-developed skills, not a state-directed external operation.¹⁶ Google also announced that DPRK-attributed clusters would use NEPTUNE as the second word in its unified naming system, while retaining old names and aliases for search.¹⁷

What to Watch

Block meeting or interview workflows that instruct users to run Terminal, PowerShell, or AppleScript commands. Verify unexpected requests through a separate channel even when they come from a known account. Groupware operators should review mail-server exposure, login-page integrity, vendor access, and unusual use of Google Drive or tunneling services from servers.

Reports Reviewed

Last week’s reporting joined two risks that often begin with developer access. Fake coding tests delivered cross-platform credential theft, while stolen developer accounts and package publishing access spread malicious code through GitHub and npm. PolinRider’s confirmed footprint rose to 4,367 repositories, and separate research connected the ChainVeil and ViteVenom package clusters to the same campaign with differing attribution confidence.

Remote employment created another path into software companies. Consensys disclosed that a consultant later linked to North Korea worked on MetaMask code for about a month, while infrastructure research mapped VPN routes, internal systems, and team-specific networks used by DPRK IT workers. Kimsuky spearphishing and separate Windows and Android surveillance tools rounded out the week.

Key Trends

1. Recruitment put developer credentials and code at risk

Elastic’s REF9403 campaign used fake recruitment and trojanized coding assignments. Payload fragments hidden in SVG flag images were reconstructed when the project ran, launching an OTTERCOOKIE-aligned JavaScript implant on Windows, macOS, and Linux. It stole browser and wallet data, collected files, monitored the clipboard, and accepted Socket.IO commands.¹

PolinRider then demonstrated what stolen developer access can enable at scale. Researchers identified 2,417 additional compromised repositories in July, bringing the confirmed total to 4,367 repositories across 2,152 owners. Configuration injection accounted for 93.9 percent of the new cases, and more than 90 percent of affected owners were individual developers.²

2. Package clusters shared infrastructure, but attribution differed

Checkmarx found seven Vite-themed npm packages linked to ChainVeil through TRON and Aptos wallets, XOR keys, loader design, and payload behavior. It assessed a common operator but did not connect that operator to North Korea.³ OpenSourceMalware later attributed ChainVeil and ViteVenom to the DPRK-linked PolinRider campaign, citing blockchain indicators it had published before the packages appeared, along with campaign markers and targeting patterns.⁴

The combined reporting supports a common technical cluster more strongly than it supports every attribution claim equally. Defenders can act on the shared wallets, keys, loader structure, and package behavior without collapsing those confidence differences.

3. IT workers reached trusted development environments

Consensys said a consultant using the alias “Tyler Knapp” was later identified through its investigation as connected to North Korea. The consultant contributed to core and mobile MetaMask code, including crypto-to-fiat functionality, for roughly one month. Consensys suspended releases and said it found no malicious code, stolen assets or data, or user impact.⁵

Stealer-log analysis separately mapped infrastructure used by DPRK fake IT workers. The records indicated routes through Russian exit nodes and VPN endpoints in the United States and Japan, linked internal networks to the Second Economy Committee, Ryonbong, and Kim Chaek University of Technology, and exposed several operational teams. A newly observed cluster labeled PUG remained unresolved.⁶

4. Spearphishing and surveillance remained active

Kimsuky impersonated diplomatic personnel and sent malicious LNK attachments with diplomatic decoys. The chains installed PebbleDash and PrxClient, added persistence and keylogging tools, and could relay command traffic to local RDP. ASEC said recent activity targeted people in the education sector.⁷

A suspected APT-C-26, or Lazarus, operation added the KKernel.exe keylogger to an existing remote-desktop surveillance platform. The service spawned an agent in the active user session, recorded keystrokes with foreground process context, and transmitted new logs every 30 seconds.⁸ S2W attributed BirdCall, a repackaged Zangi messenger, to ScarCruft. The Android spyware used Zoho WorkDrive for tasking and exfiltration and collected device data, contacts, calls, messages, directories, and files. Screenshot, microphone, and keylogging code was present but inactive in the sample.⁹

What to Watch

Run coding tests from unknown recruiters in disposable environments without browser sessions, wallets, or production tokens. Review SVG files, package import behavior, and configuration changes as executable risk. Software companies should verify remote workers throughout employment, not only at onboarding, and restrict new contractors from release systems until identity and access patterns are established.

Reports Reviewed

Last week’s reporting covered developer ecosystem compromise, digital-asset theft and laundering, and an APT37 RokRAT campaign. PolinRider expanded from npm into Go modules, Packagist packages, and Chrome extensions. The reporting tied that expansion to compromised GitHub accounts and repository release paths, putting source-control identity at the center of package security.

Cross-chain bridges and DeFi infrastructure appeared as both compromise points and laundering routes. A separate APT37 investigation traced spearphishing that impersonated a real academic conference, disguised a loader as a PDF, and used public cloud services for RokRAT command and control.

Key Trends

1. PolinRider crossed package ecosystems

OpenSourceMalware reported almost 200 malicious release artifacts tied to 111 packages and extensions, including more than 80 Go modules and 10 Packagist packages. Because those ecosystems can publish directly from repositories and tags, a stolen GitHub account can become package-registry access. The campaign hid JavaScript in configuration files and fake .woff2 files, used VS Code folder-open tasks, and delivered BeaverTail, InvisibleFerret, OtterCookie, or OmniStealer.¹

CYFIRMA likewise assessed that Famous Chollima was expanding PolinRider beyond npm into Go modules, Packagist, and Chrome extensions. It described compromised repositories and maintainer accounts as paths to developer credentials, browser data, and wallet information, while labeling its associated YARA rule low confidence.²

2. An npm backdoor delayed execution

nodemon-sudo version 3.1.16 copied the legitimate nodemon package but added tslint-conf, a repackaged logger containing a backdoor. The code did not run at installation or import. It waited until the fake logger middleware was called, then spawned a detached Node process, fetched JavaScript through a Pinata IPFS gateway, and executed it with access to require.³

SafeDep linked the package pair to earlier nodemon-node and ts-await activity through reused code and infrastructure. It also noted resemblance to a North Korea-linked npm cluster but said the attribution was based on technique and remained unconfirmed. This distinction matters because delayed execution and IPFS retrieval are useful detection leads, not proof of actor identity.

3. Cross-chain systems joined intrusion and laundering

SlowMist described Lazarus activity as a sequence spanning supply-chain compromise, social engineering, DeFi attacks, cross-chain infrastructure abuse, and laundering. Privacy protocols, bridges, lending platforms, and mixers created layered movement that made tracing harder. Its broader review recorded 182 blockchain incidents and about USD 956 million in first-half losses, with supply-chain attacks causing the largest losses by value.⁴

The Financial Security Institute estimated that Lazarus-linked or suspected activity accounted for about 63 percent of the cross-chain hacking losses it reviewed. Its cases included Ronin Bridge, Harmony Horizon, Orbit Chain, and KelpDAO, with failures involving social engineering, endpoints, validator keys, and RPC infrastructure. Reported laundering methods included decentralized exchanges, Tornado Cash, Railgun, Wasabi CoinJoin, chain hopping, wallet splitting, exchanges, and OTC networks.⁵

4. APT37 delivered RokRAT through a conference lure

Genian’s Korean and English reports assessed that Operation Capsule Vault likely began with a spearphishing email impersonating a real academic conference. An ISO image contained a PIF loader disguised as a PDF. The loader opened a legitimate decoy, decoded shellcode, and injected an x64 RokRAT variant into explorer.exe.⁶⁷

RokRAT collected host and document data, executed commands, and captured screenshots. It used pCloud, Dropbox, and Yandex for command and control. Reused Yandex credentials, infrastructure, implementation details, and code similarity to Operation Artemis supported the APT37 attribution.

What to Watch

Protect GitHub maintainer accounts and release tags with the same care as package-registry credentials. Monitor changes to tasks.json, font files containing script code, unfamiliar transitive dependencies, and Node processes that retrieve code from IPFS or blockchain services.

For document lures, connect ISO mounting, PIF execution, decoy display, process injection, and unusual cloud-service traffic. Cross-chain defenses should separately protect signer endpoints, validator independence, administrative changes, RPC infrastructure, and fund-movement monitoring.

Reports Reviewed

Last week’s reporting expanded the visible scale of DPRK access operations around developers. Ossprey mapped hundreds of Contagious Interview payload URLs and a separate Node.js RAT cluster. Other researchers documented malicious open-source packages, trojanized interview projects, compromised maintainer accounts, and GitHub personas apparently built to support fraudulent employment.

Cryptocurrency reporting focused on scale and post-theft movement. TRM attributed about two thirds of first-half losses to North Korea-linked activity, while S2W traced repeated use of mixers, bridges, swaps, exchanges, and OTC networks. Kimsuky reporting continued to favor LNK and CHM lures backed by public cloud and code-hosting services.

Key Trends

1. Contagious Interview exposed a large, mutable payload network

Ossprey identified 298 active payload URLs after malicious npm packages led researchers into a JSONkeeper dead-drop namespace. The operation delivered BeaverTail against browser, password-manager, and cryptocurrency-wallet data. A separate 36-sample Node.js RAT cluster used port 1244 with a ZT3 handshake, and researchers mapped 26 C2 servers. A live buffer-util-internal package showed that operators could rotate payloads during the investigation.¹

JFrog found Rollup-themed npm lookalikes that retrieved JSONKeeper content and launched Node.js components for remote access, browser and wallet theft, file collection, and clipboard monitoring.² Kudelski Security documented the social path into similar tooling: recruiters contacted developers through LinkedIn, WhatsApp, Discord, and CodeMentor, then pressured them to run trojanized projects. One fake Ajuna Network repository used npm install and a hidden VS Code task to start a backdoor and steal process.env secrets.³

2. PolinRider crossed package ecosystems and repository boundaries

Socket identified 162 malicious release artifacts across 108 packages and extensions linked to PolinRider, including 80 Go modules and 10 Packagist packages. Some cases involved compromised maintainer accounts and rewritten Git history. Loaders hid in configuration files or fake .woff2 files, ran through VS Code tasks, and resolved later stages through blockchain or RPC infrastructure.⁴

The affected assets extended beyond package-registry credentials. A compromised developer workstation could expose GitHub, npm, cloud, SSH, browser, and wallet secrets, then provide a route into source repositories and CI systems. This makes repository identity and release history part of the incident scope, not merely the package that first triggered detection.

3. GitHub personas supported fraudulent employment access

NorthScan identified fullstackdev0110, reo0603, and buddy0323 as a coordinated GitHub persona cluster with indicators consistent with DPRK IT worker activity. One persona reused an Indian developer’s portfolio, another person’s photograph, and contradictory identity and location data. Repeated, ordered references across unrelated historical issues suggested a shared or scripted method for manufacturing contribution history.⁵

The cluster also overlapped with proxy-interview infrastructure tied to the ghost, NeymaFullStack, and 7codewizard personas. The finding connects source-control reputation building with the same hiring channel that intrusion operators exploit through fake recruiter contact, although IT worker fraud and malware delivery remain distinct operational paths.

4. Cryptocurrency losses concentrated in infrastructure compromise

TRM recorded 207 cryptocurrency hacks and USD 972 million in losses during the first half of 2026. It attributed about USD 643 million, or 66 percent, to North Korea-linked activity, driven largely by the Drift Protocol and KelpDAO incidents. The largest losses came from keys, credentials, signing systems, and custody workflows rather than smart-contract exploits.⁶

S2W traced laundering after publicly attributed thefts involving Ronin Bridge, Horizon Bridge, Atomic Wallet, DMM Bitcoin, and Bybit. Funds moved through wallet splitting, mixers, bridges, cross-chain swaps, exchange services, OTC networks, and stablecoin conversion. THORChain, eXch, Chinese Laundromat-style brokers, and Huione-related services appeared as recurring infrastructure or settlement paths.⁷

5. Gaslight targeted both macOS data and AI-assisted analysis

Moonlock’s coverage of Gaslight described a Rust-based macOS stealer and backdoor linked to North Korean operators. It collected browser data, Terminal history, process and application lists, system profiles, and the encrypted login keychain, then used Telegram for tasking and exfiltration. The sample also embedded 38 fake system messages intended to mislead AI-assisted triage.⁸

Moonlock noted that this sample did not aggressively target wallets directly, even though its likely delivery context overlapped with prior DPRK targeting of developers, Web3 organizations, gaming companies, and fake job or meeting lures. Analysis systems should isolate untrusted sample content from model instructions.

6. Kimsuky document lures performed staged reconnaissance

AhnLab’s Korean and English monthly reports described South Korea-focused spearphishing dominated by LNK and CHM files. The chains used PowerShell, VBScript, HTA, Python, scheduled tasks, DLL side-loading, and legitimate Windows utilities to stage backdoors and infostealers.⁹¹⁰

Synaptic Systems analyzed a CHM lure that launched hidden PowerShell, decoded a VBScript bootstrap, profiled the host with WMI, uploaded folder and process inventories, and created an hourly scheduled task. The final payload appeared selective and was not returned during controlled replay.¹¹ Hauri documented a military-journal-themed LNK that used Dropbox and GitHub for VBE, batch, and PowerShell stages before collecting system details, download-directory listings, and process data.¹²

What to Watch

Run external coding assignments in disposable environments without production credentials. Record VS Code task and package-script execution, and audit repository history if a suspicious package or project ran. Credential rotation should cover source control, cloud accounts, SSH keys, registries, browser sessions, and wallets.

For Kimsuky detection, connect CHM or LNK execution with script interpreters, scheduled tasks, decoy documents, and traffic to public cloud or code-hosting services. A missing final payload does not make the reconnaissance chain benign.

Reports Reviewed

Last week’s reporting covered several routes into developer and financial environments. Internal records obtained by the BBC described a managed DPRK IT worker operation built around borrowed identities, assigned roles, close supervision, and foreign-currency quotas. Malware research documented memory-resident Windows tooling, macOS surveillance implants, malicious npm packages, and Kimsuky phishing chains.

The developer supply-chain reporting also moved beyond individual package names. Researchers described blockchain transactions as mutable dead drops for payload infrastructure, while a review of the Mastra compromise detailed how one npm account exposed 144 packages. Across these cases, the sensitive assets were often developer credentials, browser sessions, wallet data, signing access, and source code.

Key Trends

1. IT worker fraud operated as a managed organization

BBC Korea obtained recordings and internal messages describing security managers, task managers, support staff who prepared resumes and accounts, and workers who applied for remote jobs under borrowed or stolen identities. Operators recruited identity lenders through social and dating services, managed several accounts and devices, and followed rules on email, time zones, and interview language to hide their location.¹

A former worker described shared workspaces, constant monitoring, monthly foreign-currency quotas, and little personal freedom. The records portray a structured revenue operation, not isolated freelance fraud. Hiring controls therefore need to verify identity, device custody, account sharing, work location, and payment ownership before granting source-code or cloud access.

2. Developer supply chains used packages and blockchain dead drops

A review of the Mastra incident said Sapphire Sleet compromised the ehindero npm account and inserted easy-day-js@1.11.22 into 144 packages during an 88-minute publishing window. The payload established cross-platform persistence and targeted browser extensions, tokens, secrets, and CI credentials.²

A separate PolinRider teardown found loaders hidden in the functional npm packages tailwind-color-shades and safe-validate. They resolved encrypted stages through TRON, Aptos, and Binance Smart Chain transactions before contacting version-gated infrastructure and delivering BeaverTail or InvisibleFerret components.³ OpenSourceMalware described malicious-version sandwiching, campaign markers such as ace-a6-shadow-15, and the reuse of blockchain infrastructure as research pivots. It also cautioned that similar supply-chain techniques are spreading beyond DPRK operators.⁴

Contagious Interview reporting added chalk-ultra and vitest-cli. The packages downloaded tooling that stole source code, browser data, developer credentials, and wallet information, and could replace MetaMask with a persistent trojanized extension. Ossprey linked the activity to the campaign through distribution and payload overlap but kept attribution of the specific packages unconfirmed.⁵

3. macOS intrusion mixed user execution, surveillance, and analysis evasion

SentinelLABS assessed Gaslight as DPRK-aligned macOS activity with high confidence. The Rust implant used Telegram for command and control, created LaunchAgent persistence, provided an interactive shell, and ran a Python stealer against browser data, shell history, process information, system profiles, and the login keychain. Its binary also contained 38 fake system messages intended to derail LLM-assisted malware analysis.⁶

Another RAT masqueraded as MicrosoftSystem64 and bundled JavaScript inside a Mach-O binary. It supported screenshots, keylogging, clipboard monitoring, shell commands, file operations, and theft from browsers, secret files, and more than 50 wallet types. It used WebSocket traffic for tasking and an operator-controlled Hugging Face dataset for bulk exfiltration.⁷

Darktrace observed ClickFix-style macOS social engineering followed by AppleScript or other native scripting and sustained outbound signaling. It tied the use case to activity Microsoft linked to DPRK but assigned only moderate confidence based on behavioral overlap.⁸ The evidence supports behavioral detection of user-driven script execution and rare outbound control channels without treating every similar chain as confirmed DPRK activity.

4. Financial targeting favored memory-resident access

Cognyte analyzed DPAPILoader, RemotePELoader, and an in-memory RemotePE RAT used against financial institutions and cryptocurrency organizations. Windows DPAPI provided environmental keying, which made payload recovery and analysis harder away from the victim system. RemotePE supported command execution, file handling, process control, and host-data access.⁹

CYFIRMA’s quarterly review placed that tooling in a broader mix of cryptocurrency theft, supply-chain compromise, cloud intrusion, and espionage. It described Lazarus targeting exchanges, DeFi platforms, software vendors, defense contractors, and technology companies, while Kimsuky and Andariel retained distinct intelligence and sector priorities.¹⁰

5. Kimsuky kept document lures but changed supporting infrastructure

IIJ-SECT observed a KimJongRAT chain that redirected shortened email links to GitHub Releases containing LNK payloads. The chain used mshta, obfuscated VBScript, Google Drive-hosted encrypted payloads, and different execution paths depending on Windows Defender. Newer samples fetched encrypted C2 configuration at runtime and included experimental MeshAgent installation as a fallback access path.¹¹

An emulation of Kimsuky’s DEEP#DRIVE initial access reproduced an LNK that launched hidden PowerShell, downloaded staged files, opened a decoy PDF, and created scheduled-task persistence. The useful telemetry included explorer.exe spawning PowerShell and an unusual PowerShell-to-PDF-reader lineage. The post clearly separated its proof-of-concept downloads from campaign indicators.¹²

6. Embassy wireless observations remained contextual

Passive collection outside the DPRK embassy in London exposed ISP history, remembered SSIDs, printers, a television, a router, Sonos equipment, and a likely Sky Q device. The researcher said the collection occurred from public space without connecting to or authenticating with a network.¹³ These observations are physical-location OSINT, not evidence of a cyber campaign.

What to Watch

Monitor developer systems for package execution that reaches blockchain RPC services, JSON dead drops, or uncommon Node.js control channels. If a suspicious package ran, rotate repository, cloud, browser, wallet, and CI credentials from a clean host.

On macOS, connect social-engineering prompts with AppleScript, LaunchAgent creation, keychain access, and unusual Telegram, WebSocket, or Hugging Face traffic. Malware-analysis pipelines should treat extracted strings as hostile data rather than model instructions.

Reports Reviewed

Last week’s reporting centered on developer access as a route into software supply chains and cryptocurrency systems. The Mastra incident put that risk into production at scale: a compromised maintainer account added easy-day-js to more than 140 npm packages, exposing developer workstations and CI runners to a cross-platform Node.js implant. Other reports described malicious code hidden in configuration files, blockchain-based payload resolution, fake interviews, and poisoned packages.

The same access problem appeared in cryptocurrency custody. Reporting on Humanity Protocol and Bybit traced major losses to compromised workstations, exposed signing material, cloud sessions, and manipulated interfaces rather than broken cryptography. DPRK IT worker investigations showed a parallel path into companies through stolen identities, laptop farms, and fraudulent hiring.

Key Trends

1. One maintainer account exposed the Mastra release chain

Microsoft attributed the Mastra compromise to Sapphire Sleet with high confidence. The actor took over the dormant ehindero npm account and inserted easy-day-js into more than 140 mastra and @mastra packages. Mastra said the takeover followed social phishing through a compromised LinkedIn account.¹²

The malicious dependency ran during installation, disabled TLS validation, downloaded a second Node.js stage, detached it from the install process, and removed the dropper. Researchers documented Windows, macOS, and Linux persistence, browser and wallet reconnaissance, remote tasking, and possible exposure of developer and CI credentials.³⁴⁵⁶ OpenSourceMalware found close overlap with the Axios npm compromise but kept attribution unconfirmed, as did TuxCare and Snyk.⁷⁸⁹

2. Developer files, packages, and interviews all became execution paths

A developer found obfuscated JavaScript in tailwind.config.js and another backend file across several repositories. The code reportedly used TRON JSON-RPC with an Aptos fallback to resolve later infrastructure. The author linked the activity to Void Dokkaebi, while noting that initial access was still unknown.¹⁰ Checkmarx described similar blockchain-backed resolution in ChainVeil, a campaign attributed to an actor it calls SuccessKey. Its npm loaders used TRON, Aptos, and Binance Smart Chain transactions before delivering a remote-access trojan.¹¹

AhnLab’s monthly reports placed these techniques in a wider DPRK-linked pattern involving malicious Git hooks, Jenkins workflows, npm and Packagist branches, Cloudflare Workers, and blockchain RPC services.¹²¹³ ESRC tied the chai-as-init npm package to Contagious Interview after it stole environment variables and executed remote JavaScript from Vercel-hosted infrastructure.¹⁴

Recruitment supplied the social pretext. One LinkedIn lure sent a developer to a GitHub project whose npm prepare script launched a backdoor.¹⁵ A separate discussion of fake interviews described how plausible recruiter contact, broken calls, shared repositories, login prompts, and screen sharing can gradually move a target toward execution or credential disclosure.¹⁶

3. Endpoint access defeated cryptocurrency custody controls

A Humanity Protocol director reportedly opened a spearphishing email impersonating Bithumb. Malware on the director’s Windows laptop exposed MetaMask data and enough production keys to cross multisignature thresholds. The attacker then changed ProxyAdmin ownership, drained bridge assets, and enabled unauthorized token minting.¹⁷¹⁸

Bybit reporting traced the February 2025 theft to a compromised Safe{Wallet} developer workstation, stolen cloud sessions, AWS access, and injected frontend JavaScript that showed signers legitimate transaction details while changing the underlying action. Sygnia said the operation aligned with Lazarus tradecraft.¹⁹ Bybit’s later complaint attributed the theft to Lazarus acting for North Korea’s Reconnaissance General Bureau and said only about $75.5 million of the roughly $1.5 billion theft had been frozen or recovered by the filing date.²⁰ A broader Lazarus overview placed these cases beside fake recruitment, poisoned packages, IT worker infiltration, and laundering through cross-chain services.²¹

4. Document shortcuts kept script-heavy intrusion chains active

AhnLab analyzed LNK files disguised as a consent form and a resume. The consent-form chain opened a decoy while PowerShell created downloaders, scheduled-task persistence, host discovery, and an in-memory backdoor loader.²² The resume lure created batch, PowerShell, and VBScript files, registered recurring execution, downloaded later components with curl, and used DLL side-loading to run Xctdoor.²³

The information-stealing flow resembled earlier Kimsuky activity, but the reports focused on the observed execution chains rather than making a broad new attribution. The practical detection point is the process lineage from an apparent business document into script interpreters, scheduled tasks, and side-loaded DLLs.

5. IT worker operations scaled identity and access fraud

Nisos identified more than 170,000 applications to US companies over ten months, producing 76 offers for 22 operatives. The operation used appropriated identities, forged documents, AI-assisted interviews, US laptop farms, PiKVM devices, Tailscale, VPNs, and cryptocurrency payments.²⁴

Balkan Insight reported stolen identities from Bosnia and Serbia on freelance platforms, along with overseas facilitators and payment services.²⁵ Together, the cases show why hiring controls need to verify the person, device, location, remote access path, and payment owner before repository or cloud access is granted.

What to Watch

Organizations that installed affected Mastra releases should investigate the workstation or runner where installation occurred. Review lifecycle-script execution, outbound Node.js traffic, persistence, browser and wallet access, and exposure of CI secrets. Rotate credentials from a clean system and rebuild affected environments.

Run unfamiliar coding tests in isolated environments without production credentials. Cryptocurrency organizations should separate privileged keys across independently controlled systems, add timelocks to administrative changes, and verify the transaction actually signed rather than relying only on the displayed interface.

Reports Reviewed

The Humanity Protocol $H compromise was the clearest incident last week. A phishing attachment led to remote access on a director’s Windows endpoint, theft of wallet and signer material, changes to bridge and contract authority, unauthorized minting, and token sales. The incident joined endpoint security directly to protocol governance and market impact.

Developer-focused reporting covered malicious pull requests, build configuration, fake repositories, browser trust, and IT worker infiltration. APT37 and Kimsuky retained more traditional spear-phishing chains built around LNK files, scripts, cloud services, and remote control. A claimed sale of DPRK-linked data remained unverified and belongs outside the core evidence set.

Key Trends

1. One phished endpoint exposed protocol authority

Humanity’s investigation said a Bithumb-themed phishing attachment installed a signed loader and remote-access tooling on a director’s Windows machine. Stolen MetaMask and private-key material was then used to alter contract control, mint or move $H, drain operational wallets, and sell tokens.¹ Quantstamp linked the loader and supporting tooling to methods characteristic of DPRK intrusions.²

The incident update separated the affected Ethereum and BSC controls, including stolen Safe owner keys, ProxyAdmin takeover, a malicious bridge implementation, and unauthorized minting.³ The result was not simply wallet loss. Endpoint access reached bridge administration, mint authority, liquidity, and market price.

2. Pull requests and editor tasks carried supply chain risk

A malicious pull request hid an obfuscated loader in astro.config.mjs, where normal Astro build or preview commands executed it. SafeDep linked the payload to PolinRider through matching cryptographic and blockchain dead-drop artifacts.⁴ A broader campaign review traced DPRK-linked activity across npm, PyPI, Go, Cargo, Packagist, TasksJacker repository compromises, and later malicious pull requests using stolen credentials.⁵

Proofpoint’s UNK_DeadDrop cluster sent more than 250 developer-phishing emails and used GitHub or GitLab repositories, VS Code or Cursor tasks, malicious extensions, and Overlord-derived RATs to steal wallets and credentials.⁶ Google Docs research linked fake developer interview tasks with IT worker recruitment adverts through shared images and revision metadata.⁷

3. Browser and employee trust remained valuable access layers

An episode on the Google Mirror described infrastructure designed to proxy Google services around a DPRK-linked developer campaign. It did not claim that Google or a certificate authority was compromised, but it identified browser identity, mail, OAuth, account recovery, cloud drives, and source-control recovery as follow-on targets.⁸

Corelight described fraudulent IT workers using stolen or synthetic identities, laptop farms, and remote-management tooling to enter organizations with valid credentials and trusted devices.⁹ CrowdStrike’s technology-sector review likewise placed FAMOUS CHOLLIMA employment fraud beside supply chain activity by other DPRK clusters.¹⁰ These are identity and access problems as much as malware problems.

4. APT37 and Kimsuky kept tailored phishing chains active

Genians published Korean and English reports on APT37’s NarwhalRAT campaign. Microsoft-themed phishing delivered an LNK, scripts, an embedded Python runtime, and in-memory malware with keylogging, screen and microphone capture, USB staging, file transfer, and pCloud-based dead-drop resolution.¹¹¹²

A Kimsuky campaign targeted a South Korean information-security team with a personal-data leak inquiry, built trust over several emails, and resent the payload in a password-protected archive after blocking. The resulting chains used Dropbox or direct HTTPS C2, scheduled tasks, startup VBS, anti-analysis, and self-deletion.¹³

5. Marketplace claims remained unverified

DEVIL MARLBORO advertised an alleged 419 GB package containing DPRK-linked tooling, certificates, operator data, wallets, and facility information.¹⁴ The public report verified the offer, not the authenticity, freshness, or provenance of its contents. Until independent evidence emerges, the sale is a collection lead rather than proof of a breach or tool leak.

What to Watch

Blockchain projects should treat signer endpoints, Safe ownership, ProxyAdmin control, timelocks, bridge upgrades, and emergency response as one security boundary. Developer teams should review pull requests and editor automation before execution, while identity teams correlate remote employees, device location, KVM use, OAuth recovery, and unusual source-control access.

Reports Reviewed

Last week’s reporting concentrated on developer supply chains and the financial operations around cryptocurrency theft. Lazarus-linked npm brandjacking and Contagious Interview activity targeted routine dependency installation and developer workstations, while new analysis of Copperhedge described the path from server exploitation to in-memory control.

KelpDAO reporting followed stolen funds across chains and mixers, while Kimsuky infrastructure research expanded one domain into a broad cluster. Two other reports sat at the edge of the DPRK picture: Endpoint/Midnight ransomware had only a historical account overlap, and an AnySign4PC remediation notice described a vulnerability relevant to earlier exploitation reporting without attributing the flaw or all abuse to DPRK actors.

Key Trends

1. Supply chain access remained a developer problem

Sonatype attributed dozens of npm packages using brandjacked or ecosystem-adjacent names to Lazarus. One package mixed legitimate Buffer code with a loader that fetched and evaluated follow-on JavaScript.¹ A broader review found Contagious Interview publishing across npm and PyPI and noted that malicious-package growth was not confined to one ecosystem.²

An OtterCookie episode focused on what happens after execution on a real developer machine: screenshots, keyboard and clipboard capture, browser history, authenticated sessions, wallets, cloud consoles, and source-control access.³ The operational value lies in the trusted sessions surrounding the code, not simply in infecting a test host.

2. Exploitation led to in-memory Lazarus control

Analysis attributed to APT-C-26 described bulk exploitation of CVE-2025-55182 followed by MultiRelay, Akagi64, and a Copperhedge loader that decrypted its backdoor in memory.⁴ Copperhedge supported host discovery, command execution, file transfer, process control, timestamp changes, configuration updates, and reflective payload loading.

That chain links internet-facing exploitation with internal movement and a flexible backdoor. Detection should connect scanning and exploit attempts to UAC bypass, unusual rundll32 execution, encrypted configuration storage, and memory-resident payload behavior.

3. Theft and laundering extended beyond the initial transaction

A review of Lazarus financial operations used the Bybit compromise to explain signer-interface manipulation, rapid swaps, bridge use, fund fragmentation, and later cash-out paths.⁵ After the KelpDAO theft, reporting said the exploiter moved funds through Bitcoin, Wasabi, Ethereum, and Tornado Cash, leaving little in the tagged wallet while some assets remained frozen.⁶

The KelpDAO article reports the project’s attribution and recovery account, but post-theft movement alone is not an attribution test. It is most useful for monitoring bridge exits, cross-chain conversions, mixers, dormant wallets, and recovery constraints.

4. Kimsuky infrastructure scaled through repeated fingerprints

Infrastructure hunting expanded the seed domain xpo.coupang.dns.navy into 43 servers and 664 associated domains through hosting, service, HTML, and naming patterns.⁷ The report assessed moderate-to-high confidence in the Kimsuky link, but the larger pivot set still benefits from tiering by direct observation and corroboration.

5. Adjacent reports required narrow claims

AhnLab’s Endpoint/Midnight analysis described Babuk-derived ransomware for Windows, ESXi, and NAS systems, but its DPRK connection rested on a ransom-note email previously used by a North Korea-linked actor.⁸ That is relevant overlap, not attribution of the full ransomware operation.

KISA’s AnySign4PC notice advised removal or upgrade for vulnerable versions affected by a remotely exploitable buffer overflow.⁹ It adds defensive context to reports of exploitation against Korean software, but the notice itself does not name a DPRK actor.

What to Watch

Review dependency installation and package publishing alongside endpoint sessions, cloud access, and source-control credentials. For cryptocurrency incidents, preserve signing telemetry and bridge records early enough to reconstruct both the access path and subsequent laundering. Keep infrastructure pivots and historical account overlaps in separate confidence tiers.

Reports Reviewed

Last week’s reports kept developers and cryptocurrency organizations at the center of DPRK-linked activity. Fake recruiting, malicious editor tasks, compromised package branches, npm payloads, fake conferencing updates, and stolen development credentials all created paths from a single workstation into code distribution and financial systems.

Kimsuky and TA406 continued to pair tailored phishing with scripts, newly disclosed vulnerabilities, legitimate cloud services, and remote-access tooling. RemotePE supplied a separate model for long-lived access in finance, while broader reporting connected developer compromise to DeFi theft and supply chain operations. One infrastructure observation inside DPRK address space remained exploratory rather than a confirmed intrusion campaign.

Key Trends

1. Developer lures crossed package and editor boundaries

A smart-contract security developer received a fake recruiting email that led to a GitLab repository whose VS Code task installed a malicious extension and native Go implants.¹ A compromised Packagist development branch used a JavaScript loader and multi-blockchain dead drop in a likely Famous Chollima coding-task lure.² SafeDep’s MicrosoftSystem64 analysis found a cross-platform npm RAT that stole browser, wallet, Telegram, SSH, clipboard, and screen data while using Hugging Face for exfiltration.³

Sapphire Sleet used a fake Zoom SDK update against macOS users in venture capital, Web3, and cryptocurrency organizations, followed by password prompts, TCC abuse, LaunchDaemon persistence, and an in-memory beacon.⁴ Across these cases, ordinary developer and meeting workflows provided the execution path.

2. Stolen development access enabled downstream compromise

Wiz tracked JINX-0164 using recruiter lures and AUDIOFIX to steal wallet, cloud, GitHub, and CI/CD secrets before compromising software distribution and trojanizing @velora-dex/sdk.⁵ A separate analysis described the same cluster as North Korea-linked, but the original Wiz assessment found behavioral similarities without infrastructure overlap and did not attribute it to a state sponsor.⁶ The stronger conclusion is that JINX-0164 poses a directly relevant adjacent threat to the same cryptocurrency development environment.

RemotePE showed how Lazarus-linked access could persist after entry through memory-only execution, encrypted C2, plugin loading, and EDR evasion.⁷ A monthly incident review placed these techniques beside the Drift Protocol and KelpDAO thefts and the Axios supply chain compromise.⁸ ESET’s multi-month review likewise covered the Axios intrusion, developer targeting, cryptocurrency operations, and activity by Andariel and ScarCruft.⁹

3. Kimsuky and TA406 reused phishing foundations with newer components

Proofpoint observed TA406 chaining two Office and Windows vulnerabilities in diplomatic-themed RTF lures before retrieving and executing a DLL payload.¹⁰ ENKI published English and Korean analyses of Kimsuky campaigns that used fake security software and Webex pages, JSONPing localhost checks, and a new in-memory HttpSpy variant.¹¹¹²

A card-company secure-mail lure used LNK, PowerShell, mshta, obfuscated VBScript, Google Drive, and payloads for backdoor access and information theft.¹³ AhnLab’s April review placed similar LNK and script chains across South Korea-focused spear-phishing activity.¹⁴ Hauri’s KimjongRAT variant added Telegram and Discord collection and installed a MeshCentral agent, shifting the chain toward persistent remote control.¹⁵

4. Infrastructure labels can hide wider campaign roles

An investigation of a server first labeled as FTP infrastructure later connected it to OtterCookie-related collection, a reminder that one observed service may reveal only part of a campaign host’s purpose.¹⁶ Separately, NK Internet observed a captive portal framework under test in DPRK IP space, including connectivity checks, Korean comments, and a Huawei-themed WiFi error page.¹⁷

The captive portal finding supports monitoring, but it does not by itself establish a deployed phishing or access operation. Infrastructure purpose should be revised as new services and traffic become visible.

What to Watch

Treat repositories, package branches, editor tasks, conferencing updates, and development credentials as a connected attack surface. For Kimsuky and TA406 activity, correlate document and LNK delivery with localhost callbacks, script interpreters, cloud-hosted payloads, scheduled tasks, and newly installed remote-management agents.

Reports Reviewed

Developer compromise dominated last week’s reporting. Fake interviews, poisoned repositories, npm install hooks, editor automation, compiled malware, and trojanized browser extensions all targeted workstations that already held source-control, cloud, package, and wallet credentials. New reporting on Axios-related infrastructure and packages widened that picture beyond a single compromise.

RemotePE and the KelpDAO investigation showed the other end of the access chain: quiet persistence inside financial environments and manipulation of bridge verification infrastructure. Reporting on IT workers, sanctions, and operator forensics connected technical intrusion to identity fraud, laundering, and revenue generation, while two adjacent financial-sector reports required more cautious attribution.

Key Trends

1. Fake interviews turned normal developer actions into execution

A developer safety analysis described the core lure plainly: clone a repository, install dependencies, open it in an editor, or run a test on a workstation that already contains valuable credentials.¹ GitHub network analysis found Contagious Interview repositories abusing VS Code and Cursor configuration, git hooks, npm lifecycle scripts, and hidden JavaScript, with newer BeaverTail builds adding operator-directed WebSocket control.²

Trend Micro found InvisibleFerret moving into Cython-compiled Windows and macOS modules, complicating script-focused detection while preserving browser, wallet, clipboard, and keylogging functions.³ The progression from social engineering to compiled payloads and persistent control makes isolated repository review an incomplete defense.

2. npm and browser components collected developer and wallet secrets

A cross-platform Node.js stealer tied to an OtterCookie C2 targeted browser credentials, wallet data, private keys, tokens, SSH keys, and source code on Windows, macOS, and Linux.⁴ OX Security found similar breadth in terminal-logger-utils, which used a postinstall hook, bundled Node executables, Hugging Face, and WebSocket remote control.⁵

Three npm packages linked to the Axios attacker had collected developer, cloud, npm, SSH, Docker, browser, and git data for weeks.⁶ OpenSourceMalware placed those packages within parallel Contagious Interview and TasksJacker activity,⁷ while DNS analysis of the Axios operation mapped the confirmed WAVESHAPER.V2 infrastructure and separated it from unverified pivots.⁸

The browser layer was also exposed. Five trojanized extensions masqueraded as password managers or wallets, resolved C2 through an Aptos transaction, and linked stolen wallet artifacts to browser identity data.⁹

3. Financial intrusions favored durable, low-noise access

Fox-IT described RemotePE as an in-memory RAT delivered through victim-bound DPAPI decryption and a loader that unhooked DLLs, patched ETW, and resolved direct syscalls.¹⁰ The KelpDAO incident report then documented social engineering against a LayerZero developer, session-key theft, poisoned RPC nodes, monitoring evasion, and a single-verifier design that accepted the attacker’s attestation.¹¹

Chainalysis connected DPRK IT worker proceeds and cyber theft to exchanges, bridges, DeFi services, and mixers used for sanctions evasion.¹² These reports join endpoint access, cloud sessions, bridge verification, and laundering into one defensive problem.

4. IT worker and operator evidence exposed the human infrastructure

A suspected Chollima applicant used a Colombian identity and a residential Bogota connection, possibly through local facilitation or a residential proxy, while showing behavior consistent with AI-assisted interviewing.¹³ A forensic episode about a Lazarus-attributed operator disk described fake-company material, targeting pipelines, wallet artifacts, and browser traces from an eleven-hour preservation window.¹⁴

A broader campaign-linkage assessment argued that IT worker fraud, recruitment lures, cloud compromise, credential theft, and cryptocurrency operations share access and infrastructure.¹⁵ That assessment is useful as a model, but the incident-level evidence should still determine attribution in each case.

5. Financial-sector overlap did not always establish attribution

AhnLab linked observed WGear exploitation and GeniexLoader installation to activity associated with Andariel and BlueNoroff.¹⁶ Its Endpoint/Midnight ransomware analysis, however, found only that a historical ransom-note email had been used by a North Korea-linked actor; it did not attribute the ransomware family itself.¹⁷

Bridewell’s annual report supplied broader context on identity compromise, trusted-platform abuse, supply chain attacks, and attacker use of AI.¹⁸ These trend-level and adjacent findings belong below directly attributed cases in analytic confidence.

What to Watch

Inspect interview repositories before they reach a normal workstation. Block automatic folder tasks and install hooks in untrusted projects, and review browser extensions, package tokens, SSH agents, cloud credentials, and wallet access after any suspected execution. In financial environments, correlate those endpoint signals with unusual RPC changes, session-key use, and verifier behavior.

Reports Reviewed

DPRK reporting last week connected fraudulent employment, developer compromise, and cryptocurrency theft more tightly than before. Investigations into Beejern and THORSwap traced suspected IT worker activity through front companies, developer identities, repository access, and merged wallet-integration changes. A separate account-rental approach showed how remote access to a local laptop can defeat hiring-platform controls.

The technical reporting covered developer malware, bridge verification failure, and Kimsuky phishing. OtterCookie and MoonPeak supported sustained access to developer and cryptocurrency targets, while the KelpDAO case showed how a compromised verification path could unlock assets without exploiting a token contract. AI appeared both as an attacker aid and as a target-rich layer in recruiting, finance, and software development.

Key Trends

1. IT worker operations reached code and trusted workstations

NorthScan linked Beejern to a network of suspected DPRK developer personas and related companies through reused identities, exposed credentials, shared contact details, and fabricated staff images.¹ At THORSwap, a suspected DPRK worker submitted eight pull requests to SwapKit, with at least three changes to wallet and chain integrations merged.² Another operator offered to rent an Upwork identity and asked the target to install AnyDesk, illustrating how locally hosted laptops can bypass location checks.³

Forensic material from a Lazarus-attributed fake-interview pipeline added an operator-side view of persona creation, provisioning, and targeting workflows.⁴ Together, these cases place employment fraud inside the same risk model as repository access, remote administration, and credential theft.

2. Developer automation enabled surveillance and supply chain access

Contagious Interview activity abused npm lifecycle scripts and VS Code folder-open tasks to execute code during routine developer work.⁵ OtterCookie then maintained live sessions and collected clipboard data, keystrokes, screenshots, browser secrets, wallets, .env files, SSH material, and cloud or source-control credentials.⁶ A VELVET CHOLLIMA campaign used a signed trading-app MSI, GitLab-hosted stages, scheduled tasks, and MoonPeak to monitor cryptocurrency-focused victims.⁷

These chains target the credentials around code, not just the endpoint. A compromised developer can expose repositories, package publishing, CI/CD, cloud accounts, and wallet operations.

3. Crypto theft combined infrastructure compromise with laundering

The KelpDAO analysis attributed the theft to a forged cross-chain message path after Unichain RPC infrastructure was compromised. A 1-of-1 verifier design accepted the false attestation, while protocols requiring independent attestations were not affected in the same way.⁸ Arkham’s longer review placed such theft alongside AppleJeus lures, exchange compromises, bridge use, THORChain laundering, and Bitcoin fund splitting.⁹

CrowdStrike also reported a sharp rise in DPRK-linked digital asset theft and described supply chain compromise, recruiter lures, cloud access, and synthetic identities across financial targets.¹⁰ The common control problem spans signer endpoints, bridge verification, cloud sessions, developer access, and post-theft fund movement.

4. AI accelerated established operations

Google GTIG observed APT45 using AI for high-volume CVE analysis and proof-of-concept validation.¹¹ A separate assessment identified recruiting, developer assistance, fraud detection, and financial AI systems as likely access and theft targets because they hold sensitive data and delegated privileges.¹²

The evidence does not point to an entirely new operating model. It indicates that DPRK actors can apply AI to vulnerability research and identity deception while continuing to rely on familiar trust failures.

5. Kimsuky mixed phishing with legitimate remote services

Logpresso documented Kimsuky campaigns using LNK and JSE lures, PowerShell payloads, GitHub, Microsoft CDN, GitHub OAuth, and VS Code tunnels.¹³ Another campaign used a phishing LNK followed by Dropbox and GitHub stages, scheduled-task persistence, and a reflectively loaded AsyncRAT variant.¹⁴ Kaspersky’s PebbleDash and AppleSeed research added HelloDoor, httpMalice, MemLoad/httpTroy, HappyDoor, DWAgent, Dropbox, and Cloudflare tunnels to the toolset.¹⁵

For defenders, attachment inspection alone is insufficient. Monitoring should connect script execution with new GitHub or Dropbox access, VS Code tunnels, remote administration tools, and unusual OAuth use.

What to Watch

Review contractor and employee access to source repositories with the same rigor applied to production credentials. For crypto and fintech teams, repository permissions, wallet integrations, bridge verifiers, cloud sessions, and remote-access software should be investigated as one connected trust chain.

Reports Reviewed