LW24: Signer theft, malicious pull requests, and phishing RATs
Executive Summary
The Humanity Protocol $H compromise was the clearest incident last week. A phishing attachment led to remote access on a director’s Windows endpoint, theft of wallet and signer material, changes to bridge and contract authority, unauthorized minting, and token sales. The incident joined endpoint security directly to protocol governance and market impact.
Developer-focused reporting covered malicious pull requests, build configuration, fake repositories, browser trust, and IT worker infiltration. APT37 and Kimsuky retained more traditional spear-phishing chains built around LNK files, scripts, cloud services, and remote control. A claimed sale of DPRK-linked data remained unverified and belongs outside the core evidence set.
Key Trends
1. One phished endpoint exposed protocol authority
Humanity’s investigation said a Bithumb-themed phishing attachment installed a signed loader and remote-access tooling on a director’s Windows machine. Stolen MetaMask and private-key material was then used to alter contract control, mint or move $H, drain operational wallets, and sell tokens.1 Quantstamp linked the loader and supporting tooling to methods characteristic of DPRK intrusions.2
The incident update separated the affected Ethereum and BSC controls, including stolen Safe owner keys, ProxyAdmin takeover, a malicious bridge implementation, and unauthorized minting.3 The result was not simply wallet loss. Endpoint access reached bridge administration, mint authority, liquidity, and market price.
2. Pull requests and editor tasks carried supply chain risk
A malicious pull request hid an obfuscated loader in astro.config.mjs, where normal Astro build or preview commands executed it. SafeDep linked the payload to PolinRider through matching cryptographic and blockchain dead-drop artifacts.4 A broader campaign review traced DPRK-linked activity across npm, PyPI, Go, Cargo, Packagist, TasksJacker repository compromises, and later malicious pull requests using stolen credentials.5
Proofpoint’s UNK_DeadDrop cluster sent more than 250 developer-phishing emails and used GitHub or GitLab repositories, VS Code or Cursor tasks, malicious extensions, and Overlord-derived RATs to steal wallets and credentials.6 Google Docs research linked fake developer interview tasks with IT worker recruitment adverts through shared images and revision metadata.7
3. Browser and employee trust remained valuable access layers
An episode on the Google Mirror described infrastructure designed to proxy Google services around a DPRK-linked developer campaign. It did not claim that Google or a certificate authority was compromised, but it identified browser identity, mail, OAuth, account recovery, cloud drives, and source-control recovery as follow-on targets.8
Corelight described fraudulent IT workers using stolen or synthetic identities, laptop farms, and remote-management tooling to enter organizations with valid credentials and trusted devices.9 CrowdStrike’s technology-sector review likewise placed FAMOUS CHOLLIMA employment fraud beside supply chain activity by other DPRK clusters.10 These are identity and access problems as much as malware problems.
4. APT37 and Kimsuky kept tailored phishing chains active
Genians published Korean and English reports on APT37’s NarwhalRAT campaign. Microsoft-themed phishing delivered an LNK, scripts, an embedded Python runtime, and in-memory malware with keylogging, screen and microphone capture, USB staging, file transfer, and pCloud-based dead-drop resolution.1112
A Kimsuky campaign targeted a South Korean information-security team with a personal-data leak inquiry, built trust over several emails, and resent the payload in a password-protected archive after blocking. The resulting chains used Dropbox or direct HTTPS C2, scheduled tasks, startup VBS, anti-analysis, and self-deletion.13
5. Marketplace claims remained unverified
DEVIL MARLBORO advertised an alleged 419 GB package containing DPRK-linked tooling, certificates, operator data, wallets, and facility information.14 The public report verified the offer, not the authenticity, freshness, or provenance of its contents. Until independent evidence emerges, the sale is a collection lead rather than proof of a breach or tool leak.
What to Watch
Blockchain projects should treat signer endpoints, Safe ownership, ProxyAdmin control, timelocks, bridge upgrades, and emergency response as one security boundary. Developer teams should review pull requests and editor automation before execution, while identity teams correlate remote employees, device location, KVM use, OAuth recovery, and unusual source-control access.