Loading story…
Consensys halted MetaMask product releases after discovering that a contractor linked to North Korea had obtained access to MetaMask code for roughly a month in March and April through a third-party staffing provider. Reporting said the individual worked on MetaMask-related code, including core components used to connect users to third-party fiat payment providers, and the case was described as an accidental hire under a false identity tied to the broader North Korean remote IT worker scheme targeting crypto and technology firms.
Consensys said it terminated the contractor's access, opened an internal investigation, and notified law enforcement. The company stated that its review found no evidence of stolen assets, exposed user data, malicious code deployment, or impact to user safety, but the incident still forced a temporary release freeze and renewed scrutiny of hiring controls and supply-chain exposure in cryptocurrency development environments.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
After discovering the contractor's North Korea link, Consensys suspended MetaMask product releases, terminated the contractor's access, opened an investigation, and notified law enforcement. The company said its investigation found no stolen assets, exposed data, malicious code deployment, or impact to user safety.
Consensys said a contractor later linked to North Korea had access to MetaMask code for about a month during March and April through a third-party provider. The contractor contributed to MetaMask-related code, including core components used to connect users to third-party fiat payment providers.
Drop Site News reported that blockchain firm Consensys had accidentally hired a North Korean hacker, bringing the incident into public view. A later Bluesky post amplified the same headline-level claim without adding new operational details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
nknews.org
Open sourcexakep.ru
Open sourcebsky.app
Open sourcethedefiant.io
Open sourcedropsitenews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean state-sponsored hackers have adopted a novel technique known as EtherHiding to distribute malware and facilitate cryptocurrency theft. The Google Threat Intelligence Group (GTIG) has attributed this activity to a threat actor tracked as UNC5342, which is also known by several other names including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, and Void Dokkaebi. This marks the first documented instance of a state-backed hacking group leveraging EtherHiding, a method previously described by Guardio Labs in 2023. EtherHiding involves embedding malicious payloads within smart contracts on public blockchains such as Ethereum and Binance Smart Chain (BSC), allowing attackers to host and update malware in a manner that is highly resistant to takedown and difficult to trace. The campaign, codenamed Contagious Interview, targets software and web developers through social engineering, often beginning with fake job offers on LinkedIn. Attackers impersonate recruiters or hiring managers from fabricated entities like BlockNovas LLC, Angeloper Agency, and SoftGlide LLC, and eventually move conversations to platforms like Telegram or Discord. Victims are tricked into running code as part of a technical assessment, which executes a JavaScript downloader. This downloader, known as JADESNOW, interacts with the blockchain to fetch a third-stage payload, typically a JavaScript version of the InvisibleFerret malware, which is designed for long-term espionage. The payload runs in memory and may request additional components from the blockchain, such as credential stealers. The use of smart contracts for payload delivery provides anonymity, flexibility for updating malicious code, and evasion of traditional detection and takedown mechanisms. The attackers' ability to retrieve payloads from either Ethereum or BSC further complicates analysis and defense. The campaign's objectives align with North Korea's dual goals of cyber espionage and financial gain, as the malware is used to steal sensitive data and siphon cryptocurrency assets from compromised developers. The cost to update the malicious payload is minimal, averaging around $1.37 in gas fees, making the technique both economical and scalable for the threat actors. The use of read-only calls to fetch payloads leaves no visible transaction history, enhancing the stealth of the operation. This development represents a significant evolution in the tactics of North Korean cyber operations, demonstrating their increasing sophistication and willingness to exploit decentralized technologies for malicious purposes. Security researchers warn that the resilience and anonymity provided by blockchain-based malware delivery could inspire similar tactics among other threat actors. Organizations are advised to increase vigilance, especially when dealing with unsolicited job offers and technical assessments that require code execution. The campaign underscores the importance of robust security awareness training and technical controls to detect and prevent such advanced social engineering and malware delivery techniques.
Jun 29, 2026
North Korean state-sponsored threat actors have significantly escalated their 'Contagious Interview' campaign by flooding the npm registry with over 338 malicious packages designed to steal cryptocurrency and sensitive credentials. The operation leverages a repeatable playbook, with threat actors creating more than 180 fake personas and using new npm aliases and registration emails to distribute the malware. These malicious packages have collectively been downloaded over 50,000 times, indicating a substantial reach and potential impact on the developer community. The attackers primarily target Web3, cryptocurrency, and blockchain developers, as well as technical job seekers, often approaching them on LinkedIn under the guise of recruiters or hiring managers. The campaign follows a multi-stage attack chain, beginning with reconnaissance on social media, followed by weaponization through the publication of typosquatted npm packages. Delivery occurs via recruiter lures, leading to exploitation through malware loaders that execute in memory. The malware tooling has evolved, with initial stages using direct BeaverTail droppers, and more recent waves employing HexEval, XORIndex, and encrypted loaders that reconstruct BeaverTail in memory. Once executed, these loaders typically fetch the InvisibleFerret backdoor, which establishes persistence and enables further malicious actions. The attackers use over a dozen command and control endpoints to manage the compromised systems. The campaign is iterative, with new malicious packages appearing weekly and loader code being regularly tweaked to evade detection. The npm security team has been notified, and takedown requests have been submitted, but as of the latest reports, 25 malicious packages remain live on the registry. The operation has resulted in multi-stage compromises, including the theft of wallet keys and sensitive credentials, leading to financial losses for victims. The attackers' use of social engineering, technical obfuscation, and rapid distribution across new aliases demonstrates a high level of sophistication and adaptability. The campaign has been mapped to the Lockheed Martin Cyber Kill Chain, illustrating its comprehensive approach from reconnaissance to actions on objectives. Security researchers emphasize the need for heightened vigilance among developers, especially those in the cryptocurrency and blockchain sectors, and recommend immediate review of npm dependencies and enhanced monitoring for suspicious package activity. The ongoing nature of the campaign and the attackers' ability to quickly adapt their tactics pose a persistent threat to the software supply chain. Organizations are urged to implement robust security controls, educate staff about social engineering risks, and coordinate with npm and security vendors to mitigate exposure. The incident highlights the growing risk of supply chain attacks via open-source ecosystems and the need for industry-wide collaboration to address such threats.
Jun 29, 2026
North Korea-linked operators tracked as **HexagonalRodent**, **Contagious Interview**, and overlaps of **Lazarus/Famous Chollima** used fake recruiter outreach on LinkedIn and sham company infrastructure to lure software and Web3 developers into opening malicious coding assessments. Researchers said the campaign delivered malware including **BeaverTail**, **InvisibleFerret**, and **OtterCookie** through backdoored GitHub repositories, rogue npm content, malicious VS Code `tasks.json` execution, and weaponized Git hooks such as `pre-commit` and `post-checkout`. The malware targeted Windows, macOS, and Linux systems, stealing browser credentials, keychains, wallet data, seed phrases, and developer secrets while maintaining persistence and remote access.
Aug 14, 2026