North Korean Hackers Shift to Phishing Campaigns Targeting Crypto Firms

North Korean hackers, under the BlueNoroff subgroup of the Lazarus Group, have escalated their cyberattacks, shifting from social media manipulation to targeted phishing emails in their 'Hidden Risk' campaign.

These emails, disguised as crypto news or DeFi updates, lead to malware-laden links that bypass security features like macOS’s Gatekeeper, allowing hackers to steal sensitive data.

As the cryptocurrency sector grows, North Korean hackers are increasingly focusing on DeFi and ETF firms, using phishing and social engineering to target employees.

The FBI has issued warnings, urging firms to strengthen security and cross-check wallet addresses.

The Lazarus Group has also exploited privacy protocols like RailGun for crypto money laundering, prompting U.S. sanctions on services like Tornado Cash.

Experts advise cryptocurrency firms, particularly those on macOS, to enhance security with regular malware scans and careful scrutiny of email attachments to defend against these evolving threats.