Operation Phantom Circuit was a Lazarus Group data-exfiltration campaign active from at least September 2024 and affecting hundreds of cryptocurrency and technology developers worldwide. Operators embedded malware in trusted development applications and routed activity through proxy infrastructure in Russia to broaden reach and hinder detection. The campaign used dedicated command-and-control systems and a concealed administrative platform to communicate with infected hosts, organize stolen information, and maintain long-term access, reflecting a shift toward compromising trusted software for scalable impact.