Supply Chain Attack
One operator, four poisoned npm packages, over a billion combined weekly downloads. AWS's own report links axios, debug, chalk and typo-crypto to North Korea's Sapphire Sleet at medium confidence — and lays out how the group's tradecraft is shifting into the generative-AI era.
North Korean Threat Actors
North Korea's Contagious Interview operation has moved into macOS malvertising — a sponsored search result loads a fake full-screen update that ends in a drained crypto wallet. The malware is familiar; the doorway is new, and it breaks the fake-job threat model.
Supply Chain Attack
Two more package hijacks, one DPRK attribution — Amazon's callout lands this week.
North Korean Threat Actors
Another BlueNoroff cryptocurrency-targeting operation lands — a defender review for crypto-industry Zoom users this week, framed around wallet-profiling awareness rather than kit mechanics.
Nation-State Cyber Threats
ENKI says Kimsuky ran a March-April 2026 wave against South Korean military and corporate targets, delivering an HTTPSpy variant through a fake Webex meeting page wired to a real scheduled event and a new infection-verification technique it calls JSONPing.
Nation-State Cyber Threats
Fox-IT disclosed RemotePE, a RAT the North Korea-linked Lazarus Group runs entirely in memory and never writes to disk. It is the final stage of a multi-stage chain, deployed only after the noisier RATs are deliberately cleaned up.
North Korean Threat Actors
Federal prosecutors sentenced two U.S. nationals — Matthew Isaac Knoot of Nashville and Erick Ntekereze Prince of Naples, Florida — to 18 months each for running "laptop farms" that helped North Korean IT workers fraudulently obtain remote employment at nearly 70 American companies. They are the seventh and eighth
Threat Intelligence
ESET disclosed a North Korea-aligned APT37/ScarCruft supply-chain compromise of sqgame.net, a Yanbian-themed gaming platform serving the ethnic-Korean community on the China-North Korea border. Trojanized Android APKs deploy a new BirdCall backdoor port. The APKs are still live.
Threat Intelligence
North Korean threat actors have escalated their developer-targeting campaign by using an AI large language model to insert malicious npm dependencies into legitimate projects — operating through fake U.S.-registered companies and deploying full-featured remote access trojans targeting cryptocurrency wallets and developer infrastructure. GLOBAL — Cybersecurity researchers at ReversingLabs
Threat Intelligence
An update on the macOS ClickFix threat: North Korean actors Sapphire Sleet and UNC1069 are now deploying AppleScript-based delivery chains and "Terminal-paste" lures to steal crypto-wallets and credentials from enterprise targets. SEOUL, SOUTH KOREA — The "ClickFix" social engineering phenomenon has officially evolved into
Crypto-Crime & Laundering
Blockchain security researchers and protocol developers have identified the North Korean state-sponsored Lazarus Group as the primary suspect in the staggering $290 million theft from Kelp DAO. SEOUL, KOR — The decentralized finance (DeFi) ecosystem is reeling after a sophisticated exploit targeted Kelp DAO, a leading liquid restaking protocol. Early
Artificial Intelligence (AI)
OpenAI has taken the drastic step of rotating its developer signing certificates for macOS, forcing a mandatory update for all desktop users after a critical third-party library was linked to state-sponsored malware. SAN FRANCISCO, CA — OpenAI has confirmed it is rotating the digital certificates used to sign its