Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
Amazon Threat Intelligence has attributed the September 2025 hijack of the popular npm packages debug and chalk to North Korea's Sapphire Sleet…
Tag: cryptocurrency
STARDUST CHOLLIMA: North Korean Hacking Group
STARDUST CHOLLIMA is another alias for the North Korean threat group also known as Sapphire Sleet and UNC1069, involved in cryptocurrency theft…
CageyChameleon: North Korean Cyber Group
CageyChameleon is a North Korean cyber group associated with cryptocurrency theft and malware campaigns, overlapping with Sapphire Sleet.
CryptoCore: North Korean Hacking Group
CryptoCore is a North Korean threat actor focused on cryptocurrency theft, also known as BlueNoroff and Sapphire Sleet.
typo-crypto npm Package
typo-crypto is a malicious npm package designed to impersonate crypto-js, first published in March 2025. It contained a trojanized file (core.js) and…
Malvertising Campaign SourTrade Uses Browser to Assemble Malware Executable from Pieces
A malvertising operation named SourTrade, active since late 2024, uses victims' browsers to build a Windows executable from components served across multiple…
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate…
ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password
Group-IB has identified a new macOS infostealer, ClickLock Stealer, that uses a coercive technique to force victims to enter their login password.…
Tonkeeper Cryptocurrency Wallet
Tonkeeper is a cryptocurrency wallet targeted by OkoSpyware through browser title matching.
Trezor Suite Desktop Application
Trezor Suite is the official desktop application for managing Trezor hardware wallets. It was targeted by the SeedHunter module for phishing recovery…