NorthKoreaHackers

🚨 Millions at Risk! CoinMarketCap Breach + North Korean Hack Attack Explode Crypto Chaos 🔐

CoinMarketCap, the go-to crypto site for millions, suffered a shocking security breach on June 20. Hackers injected malicious JavaScript into the site’s rotating “Doodles” animation, which showed users a fake wallet “verification” pop-up. Anyone who clicked it was redirected to a wallet drainer named “Impersonator,” silently stealing tokens. The attack worked by exploiting the JSON configuration of the doodles, likely via a flaw in their animation engine. Although CoinMarketCap quickly removed the code and patched the site, many users who approved transactions could already be compromised. 😨
Security experts revealed that this was a highly planned attack, likely involving backend access, making it more dangerous than a typical scam. The malicious wallet address receiving funds has been identified, and crypto users are strongly advised to revoke any recent wallet permissions and stay alert when visiting familiar websites. One user summed it up on X: “You’re just checking a site you visit every day — no red flags, no warning. That’s what makes it so dangerous.” 🧠💻
On top of that, Taiwanese crypto exchange BitoPro also confirmed a $11 million hack linked to North Korea’s Lazarus Group. The hackers used social engineering to infect an employee's device, bypassed multi-factor authentication, and injected malicious scripts into the hot wallet system during a routine update on May 8. The stolen assets were moved across Ethereum $ETH , Solana $SOL , Tron $TRX , and other blockchains, then laundered through mixers like Tornado Cash. With threats from both front-end breaches and state-sponsored attackers, it’s a tough week for the crypto world. 🌍🔓
#CoinMarketCap #Hacked #NorthKoreaHackers

💣 New Malware Targets Blockchain Workers — Fake Jobs, Real Threats! 🧠🔐

North Korean hackers are at it again — this time with a sneaky new trick targeting professionals in the crypto industry! 🇰🇵💻 A hacking group known as “Famous Chollima” (aka “Wagemole”) has been using fake job offers to lure crypto experts into downloading a nasty piece of malware called PylangGhost. According to Cisco Talos, this malware is designed to remotely control your computer and steal passwords from crypto wallets and browser extensions like MetaMask, 1Password, and more. 😨🔑
These cybercriminals are impersonating major companies like Coinbase and Uniswap by setting up fake websites and posing as recruiters. Once victims are hooked, they’re guided through a bogus interview process and tricked into running malicious code on their system — all under the pretense of installing a “video driver.” Once the malware is in, it grabs login details, takes screenshots, steals data, and keeps the door open for further attacks. 📷📂🕵️
This isn’t the first time North Korean hackers have pulled this kind of stunt. Similar scams were seen in April, where fake recruitment tests were used to hack developers in the crypto space. As crypto adoption grows, so does the interest from cybercriminals. So, if you're job-hunting in the blockchain world, double-check those offers and never run unknown code — your crypto stash could depend on it! 🔒🛡️
#cryptohacks #NorthKoreaHackers $BTC

A North Korean state-linked hacking group is deploying a sophisticated cyber campaign aimed at infiltrating top crypto firms through fake job application processes, according to new research by Cisco Talos.
The group, known as Famous Chollima, is distributing a Python-based remote access trojan (RAT) dubbed PylangGhost, which is disguised as part of a fake hiring process. Victims—primarily blockchain professionals in India—are being lured via polished fake career sites impersonating companies like Coinbase, Robinhood, and Uniswap.
Once a candidate fills out basic information and completes a staged technical assessment, they’re prompted to run a terminal command that secretly installs the malware. The malicious code is bundled inside a ZIP file that contains a renamed Python interpreter (nvidia.py), Visual Basic scripts, and multiple modules enabling full system access, including file transfer, browser data theft, and credential harvesting.
The PylangGhost malware is a rewrite of the earlier GolangGhost RAT, retaining similar naming conventions and functionalities, but tailored for Windows systems. Mac users are still being targeted with the original Golang version, while Linux systems remain largely unaffected.
Cisco notes that while there's no direct evidence of corporate network compromise, the broader goal appears to be preemptive infiltration—gaining access to individuals before they’re hired into sensitive roles at major firms.
The malware’s design allows it to extract credentials, session cookies, and wallet data from more than 80 popular browser extensions, including MetaMask, Phantom, and 1Password. All data transfers are routed via RC4-encrypted HTTP packets—an outdated and vulnerable encryption method.
This campaign highlights the increasing sophistication of cyber operations linked to the DPRK, with malware now embedded in social engineering attacks targeting both individual and institutional actors in the crypto ecosystem.
#NorthKoreaHackers

North Korean hacking groups have once again demonstrated how dangerously sophisticated they can be. This time, they’ve set their sights on crypto developers — posing as legitimate U.S.-based companies with one goal: to infect victims’ systems with malware.

🎭 Two Fake Companies. One Malicious Scheme.
Cybersecurity firm Silent Push has revealed that North Korean hackers created two LLCs — Blocknovas LLC in New Mexico and Softglide LLC in New York — pretending to be recruiters in the crypto industry. These companies sent “job offers” that contained malicious code. The notorious Lazarus Group, linked to North Korea’s intelligence services, is believed to be behind the operation.
A third entity, Angeloper Agency, showed the same digital fingerprint, though it wasn’t officially registered.

🧠 Malware That Steals Crypto Wallets
Once unsuspecting developers opened the infected files, the malware began harvesting login credentials, wallet keys, and other sensitive data. According to Silent Push’s report, multiple victims have already been identified — most linked to the Blocknovas domain, which was by far the most active.
The FBI has seized the domain and issued a warning that similar aliases may reappear soon.

💸 Covert Funding for North Korea’s Missile Program
According to U.S. officials, the ultimate goal of the scheme is simple: generate hard currency to fund North Korea’s nuclear weapons program. Intelligence sources say Pyongyang has been deploying thousands of IT operatives abroad to illegally raise funds through fraudulent schemes.
This case is especially troubling because it shows that North Korean hackers managed to set up legal companies inside the United States, a rare and alarming development.

🔐 Three Malware Families, One Lazarus Signature
Analysts found that the job files contained at least three known malware families, capable of opening backdoors, downloading additional malicious payloads, and stealing sensitive information. These tactics align closely with past attacks by the Lazarus Group.

⚠️ FBI Warning: Be Cautious of "Too Good to Be True" Job Offers
Federal agents emphasize that this case is a chilling reminder of how North Korea continues to evolve its cyber threats. Tech and cybersecurity professionals should thoroughly vet unsolicited job offers, especially those from unfamiliar companies. Developers infected by these schemes could lose cryptocurrency or unknowingly grant hackers access to larger systems and exchanges.

#HackerAlert , #CyberSecurity , #NorthKoreaHackers , #CryptoSecurity , #CryptoNewss

Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“

North Korean Hackers Orchestrate Sophisticated Attack
A recent postmortem report reveals that North Korea-backed hackers, identified as UNC4736 (also known as Citrine Sleet), exploited Radiant Capital in a $50 million attack. The operation involved advanced social engineering tactics, with the attackers impersonating a "trusted former contractor" and distributing malware via a zipped PDF file.
Phishing Through Fake Domains and Data Manipulation
The hackers created a fake domain mimicking a legitimate Radiant Capital contractor and reached out to the Radiant team through Telegram. They requested feedback on an alleged smart contract audit project. However, the shared file concealed INLETDRIFT malware, which created macOS backdoors, granting the hackers access to hardware wallets of at least three Radiant developers.
Manipulated Transactions and Compromised Security
During the attack on October 16, the malware tampered with the Safe{Wallet} interface (formerly Gnosis Safe), displaying legitimate transaction data to developers while executing malicious transactions in the background. Despite adhering to stringent security protocols like Tenderly simulations and Standard Operating Procedures (SOP), the attackers successfully compromised multiple developer devices.
UNC4736’s Links to North Korea
According to cybersecurity firm Mandiant, UNC4736 is connected to North Korea's General Reconnaissance Bureau. This group is notorious for targeting cryptocurrency companies and financial institutions globally.
North Korean Hackers Fund Nuclear Programs
The Federal Bureau of Investigation (FBI) has previously warned about North Korean hackers’ sophisticated tactics, including targeting cryptocurrency exchanges and prominent firms. Research indicates that these state-backed groups have stolen approximately $3 billion from the cryptocurrency sector since 2017. The stolen funds are reportedly used to finance North Korea's nuclear weapons program.
A Concerning Trend in Cybersecurity
This case highlights the increasing sophistication of cyberattacks, as hackers deploy social engineering and advanced tools to target cryptocurrency firms. Radiant Capital fell victim to a meticulously planned operation, underscoring the urgent need for enhanced security measures within the crypto industry.

#CryptoNewss , #NorthKoreaHackers , #hackers , #Cryptoscam , #CryptoSecurity

Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“