698 reports
DEV#POPPER used a fake contract-development assessment to induce software developers to execute a poisoned private repository through `npm run dev`. Red Asgard assesses the campaign as DPRK-consistent and traces it from a Vercel-hosted loader through a TR…
DEV#POPPER compromised contract developers through realistic private GitHub coding assessments whose Tailwind configuration executed a disguised JavaScript loader when `npm run dev` was launched. The recovered implant used TRON and BNB Smart Chain transac…
AccuraSoftHire used a fabricated recruiting presence and malicious coding assignments, camera drivers, and browser-extension instructions to compromise developer machines with the PolinRider loader. StepSecurity identified nine poisoned npm packages and d…
BlueNoroff expanded its targeted Web3 social-engineering operation from fake meetings into document-sharing, media-player, identity-verification, wallet-access, security-audit, and investment lures while preserving the same user-executed compromise model.…
The Justice Department disrupted cloud infrastructure supporting FaceStealer, a DPRK social-engineering campaign that uses stolen accounts, recorded webcam footage, deepfakes, and fake conferencing fixes to install malware and steal cryptocurrency. The ca…
The FBI attributes the FaceStealer campaign to North Korean state-sponsored hackers tracked under names including Sapphire Sleet, UNC1069, APT38, BlueNoroff, and Stardust Chollima. The actors reportedly stole more than $400 million in cryptocurrency over …
Constella Intelligence found that a potential Binance employee's Mac reached a fake Homebrew page through a Google ad and began running a MacSync-style stealer 16 seconds later, exposing the login password, Keychain data, OAuth tokens, and 57 Binance-link…
Stormshield attributes Trigram with high confidence to North Korea and assesses it as an evolved continuation of the UNK_DeadDrop cluster, with infrastructure and operator identifiers overlapping Kimsuky reporting. The campaign impersonates about 50 AI, b…
SEAL recorded four DPRK-related cases, including UNC1069 fake Teams invitations, an interrupted Contagious Interview repository attack, a $35,000 PolinRider loss, and research into the UNK_DeadDrop job-lure cluster. The Contagious Interview repository abu…
Material tracked 2,429 suspected DPRK IT-worker personas over 12 months, including 1,100 that reached interviews or later stages and 27 that progressed to onboarding activity. Forty-one percent appeared at multiple organizations, demonstrating systematic …
Elliptic traced North Korean laundering of proceeds from the $6.4 billion Binance theft through disposable tokens and decentralized-exchange liquidity pools on Tron and NEAR, with a related technique used on Solana. Six newly created NEAR meme tokens move…
JFrog uncovered AccuraSoftHire, a fabricated recruitment company that delivered malware through poisoned npm dependencies, coding assignments, and a deliberately failing camera-verification workflow. Its loader used an Ethereum transaction as a dead drop,…
Bitquery tracked the first week of laundering after the October 2026 Binance theft and found that $333 million had moved across chains or been cashed out by 6 November. It reports that $208 million moved during the first two and a half days, mainly from T…
Michael Koczwara correlates TraderTraitor infrastructure from two reported ROOFDECK C2s to 13 certificate-linked endpoints using shared mkcert issuer metadata, Authority Key Identifier values, TLS fingerprints, HTTP-response characteristics, and historica…
FinCEN ordered U.S. financial institutions to stop processing transfers involving MEXC Global after Treasury identified the cryptocurrency exchange as a conduit for illicit finance, including North Korean sanctions evasion. Treasury said MEXC Global facil…