Zscaler uncovered a July 2026 campaign using a trojanized Terraform provider to execute a Bash loader and deliver FLATROOF and ROOFDECK across macOS, Linux, and Windows. FLATROOF provides persistent command execution and deploys Python stealers for browser credentials, cookies, shell history, system data, and cryptocurrency-wallet extension artifacts, while ROOFDECK uses Pastebin and Nostr as resilient C2 discovery channels. The activity significantly overlaps with the KelpDAO incident and established TraderTraitor targeting of cryptocurrency and Web3 developers. Zscaler links the campaign to the North Korean government-backed group but states that unique code, infrastructure, or cryptographic evidence was insufficient for independent high-confidence attribution.