Loading story…
Researchers detailed two likely DPRK-linked malware operations that used public blockchains as resilient command-and-control infrastructure while targeting the cryptocurrency ecosystem and software developers. Elastic Security Labs said the PHANTOMPULSE Windows RAT, delivered through abused Obsidian plugins and the PHANTOMPULL loader, used multiple process-injection techniques, a schuac-based UAC bypass via IElevatedFactoryServer, hardware breakpoints to suppress AMSI, WLDP, and ETW, and scheduled tasks for persistence. The implant conducted host reconnaissance, screenshot capture, keylogging, and clipboard monitoring, and resolved its latest C2 by reading transaction data from Ethereum, Base, and Optimism, with Telegram and hardcoded-domain fallback paths also noted.
A separate supply-chain intrusion attributed to Famous Chollima compromised the legitimate Packagist package roberts/leads, hiding malicious JavaScript in a development-branch tailwind.js file that fetched encrypted payloads from TRON, Aptos, and BNB Smart Chain. Socket linked the activity to prior DPRK tooling including DEV#POPPER RAT, OmniStealer, and BeaverTail, while public reporting and social-media tracking tied it to the broader Contagious Interview ecosystem. Elastic said PHANTOMPULSE's blockchain resolver failed to verify transaction senders, creating a rare opportunity for defenders to sinkhole infected hosts with a crafted transaction, and advised monitoring suspicious scheduled tasks, unusual rundll32.exe execution, hardware-breakpoint tampering, and Node.js access to blockchain or RPC services during builds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The compromised development version of the roberts/leads package was reported and subsequently removed from Packagist. This was part of the response to the supply-chain attack targeting PHP developers.
Socket.dev identified a supply-chain attack involving the legitimate PHP package roberts/leads on Packagist, where malicious JavaScript was hidden in a development branch file named tailwind.js. The activity was attributed to Famous Chollima and used blockchain platforms including TRON, Aptos, and BNB Smart Chain to retrieve encrypted payloads.
A Bluesky post by lazarusholic shared Socket’s article about Famous Chollima targeting PHP developers through a compromised Packagist package. The post tagged the activity with #ContagiousInterview, #FamousChollima, and #DPRK.
In its PHANTOMPULSE analysis, Elastic assessed the tradecraft, targeting, and infrastructure as aligned with DPRK-linked crypto-focused clusters including Lazarus, BlueNoroff, UNC5342, and APT38. The assessment tied the malware campaign to North Korean threat activity targeting the cryptocurrency sector.
Elastic Security Labs published analysis of PHANTOMPULSE, the final-stage implant in the REF6598 intrusion set, detailing its injection methods, persistence, UAC bypass, and blockchain-based C2 resolution. The report highlighted that the resolver does not verify transaction senders, creating an opportunity for defenders to sinkhole implants with a crafted transaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcebsky.app
Open sourceelastic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Cloud's Mandiant reported that North Korean operators adopted **EtherHiding**, a technique that abuses blockchain infrastructure to hide malicious content and stage malware delivery. The activity uses decentralized platforms to store or retrieve attacker-controlled data, complicating takedown efforts and making network-based detection harder because the infrastructure blends into legitimate blockchain traffic. The report links the tradecraft to DPRK threat activity and highlights a broader shift toward resilient, hard-to-disrupt hosting for command-and-control or payload staging. By moving parts of the infection chain onto blockchain-backed services, the operators reduce reliance on traditional attacker domains and hosting, increasing the durability and stealth of malware campaigns targeting victims across the internet.
Jun 29, 2026
North Korea-linked operators tracked as **HexagonalRodent**, **Contagious Interview**, and overlaps of **Lazarus/Famous Chollima** used fake recruiter outreach on LinkedIn and sham company infrastructure to lure software and Web3 developers into opening malicious coding assessments. Researchers said the campaign delivered malware including **BeaverTail**, **InvisibleFerret**, and **OtterCookie** through backdoored GitHub repositories, rogue npm content, malicious VS Code `tasks.json` execution, and weaponized Git hooks such as `pre-commit` and `post-checkout`. The malware targeted Windows, macOS, and Linux systems, stealing browser credentials, keychains, wallet data, seed phrases, and developer secrets while maintaining persistence and remote access.
Jul 17, 2026
Elastic Security Labs reported a **Contagious Interview** intrusion tied to a DPRK-aligned threat cluster after suspicious activity targeted Elastic’s community Slack workspace. Using a fake recruiter persona named **Maxwell**, the operator posted a fraudulent job opportunity and coding challenge that directed victims to trojanized **Next.js** e-commerce repositories. The malicious code hid payload components inside SVG image files using steganography, embedding Base64 fragments in flag images that were reassembled by `serverValidation.js` and executed with `eval()` when the local development server started. The campaign matches the broader **Contagious Interview** tradecraft tracked in **MITRE ATT&CK** as **G1052**, which relies on fake hiring outreach, code-repository lures, and social engineering to infect developers across **Windows, macOS, and Linux**. Elastic said the infection chain deployed a browser credential and crypto-wallet stealer, a file stealer, a persistent **Socket.IO** RAT, and a clipboard stealer capable of fetching Windows PE payloads, while code similarities to **OTTERCOOKIE** and infrastructure overlaps previously documented by JFrog reinforced the attribution. MITRE also associates the cluster with malware such as **BeaverTail** and **InvisibleFerret**, along with credential theft, financial theft, persistence through platform-specific startup mechanisms, and exfiltration over C2 and cloud or messaging services.
Jul 21, 2026