North Korea's Crypto Heists Start on the Open Internet

North Korean threat actors, identified as the Lazarus Group, conduct cryptocurrency thefts by initially compromising developers through social engineering on the open internet. They trick developers into running malicious projects, which leads to planting malware in cryptocurrency wallet interfaces, as seen in the February 2025 Bybit theft and a similar Binance compromise. These operations use pre-registered domains and US-registered front companies to deliver malware, including through fake job interviews. Preemptive defenses have identified numerous malicious domains mimicking Binance, enabling defenders to block infrastructure before attacks occur.

• Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto TiesMalware2026-09-19
• Fake iPhone Duo preorder scam triggers DarkSword attackMalware2026-09-29
• A new version of the MacSync macOS stealer targets crypto enthusiasts and developersMalware2026-09-24
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02
• Hackers Impersonate IT Help Desk on Microsoft Teams to Hijack Active Directory Accounts and Steal DataMalware2026-10-31