508 reports
Attackers exploited LayerZero Labs infrastructure on 18 April 2026, causing more than $300 million in losses across DeFi protocols and prompting two additional forged transactions totaling over $100 million before Kelp paused contracts. The excerpt says i…
ScarCruft compromised a Yanbian-focused gaming platform in a supply-chain attack aimed at ethnic Koreans in China's Yanbian region, an area linked to North Korean refugees and defectors. The Windows client was affected through a malicious update that led …
OpenSourceMalware reports that DPRK Contagious Interview and TaskJacker operators are hiding a second-stage loader inside Git pre-commit hooks instead of prior locations such as VS Code tasks, package postinstall scripts, or fake font files. The hook fing…
Aave LLC’s court filing seeks to vacate a restraining notice served on Arbitrum DAO in litigation involving plaintiffs against the Democratic People’s Republic of Korea. The memorandum says the restrained assets relate to the rsETH Incident and the April …
A five-package npm cluster used Cloudflare Pages and Workers infrastructure to deliver PylangGhost RAT. The packages shared related maintainer names, email patterns, publish timing, and dependency links, leading the source to assess they were likely opera…
BlueNoroff is using fake Zoom meetings, deepfake participant media, and ClickFix clipboard injection to target cryptocurrency and Web3 executives. The attack starts with Calendly-based social engineering and typo-squatted meeting domains, then tricks vict…
Plausible Deniability pivots from Team Cymru's reporting on DPRK IT worker infrastructure to identify a possible related Luckyguys cluster centered on luckyguys[.]cloud. The domain was registered close to luckyguys[.]site through the same registrar, hoste…
DomainTools characterizes DPRK Contagious Interview activity as a Lazarus developer-workflow compromise model that turns fake recruiting and coding assessments into initial access. Victims are pushed to clone and run repositories that hide malicious logic…
TRM Labs attributes about USD 577 million in 2026 crypto theft through April to North Korean hacking groups, with Drift Protocol and KelpDAO accounting for 76% of all crypto hack losses in that period. The Drift attack involved weeks of on-chain staging, …
HexagonalRodent is presented as a DPRK-attributed crypto-theft operation overlapping with Famous Chollima, Contagious Interview, and the broader Lazarus/TraderTraitor ecosystem. The campaign targets Web3 and DeFi developers through AI-generated LinkedIn r…
The episode describes DPRK-linked Contagious Interview activity using fake coding interviews to turn developer work into credential theft. The preserved notes focus on malicious coding tests, developer workstation compromise, malware infrastructure, and t…
Red Asgard launched The Fake Interview as an audio companion to its Hunting Lazarus research series on the DPRK-linked Contagious Interview campaign. The source says the written investigation tracks fabricated companies, persona operators, malicious repos…
RedAsgard found five Lazarus/Contagious Interview operator workstations inside the campaign's own victim database, showing that the credential-theft pipeline also consumed the people running it. The campaign targeted cryptocurrency, Web3, developer, and f…
ReversingLabs linked PromptMink to the North Korean-linked Famous Chollima group, describing a software-supply-chain campaign that used layered npm packages to target Web3 and crypto development workflows. A Claude Opus co-authored commit added the malici…
SOOHO.IO's bulletin describes the April 18, 2026 KelpDAO rsETH bridge incident, in which 116,500 rsETH, about $290 million to $294 million, was released from the Ethereum escrow contract without a valid source-chain burn. The source frames the failure as …