Amazon linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers.

BlueNoroff, a financially motivated threat cluster linked to the Lazarus Group, has been observed deploying a highly sophisticated “fake meeting” phishing kit.

Researchers from Kaspersky’s Global Research and Analysis Team (GReAT) uncovered technical links between the headline-grabbing supply chain attack on Axios, one of the world’s most widely used JavaScript libraries, and previously documented campaigns associated with BlueNoroff, a financially motivated subgroup of the infamous Lazarus Group. Axios is one of the most widely used JavaScript HTTP [...] The post Kaspersky GReAT identifies Bluenoroff link in major supply chain attack appeared first on NCN Online .

BlueNoroff is hijacking Telegram accounts and using fake Zoom and Teams meetings to deliver malware targeting Bitcoin and crypto professionals.

Amazon Threat Intelligence links the compromise of axios, debug, chalk, and typo-crypto to a North Korean group tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA, and BlueNoroff. The campaign spanned over a year and introduces a new tactic: attackers are training operations to evade AI-powered automated

At a glance Actor DPRK-linked group (Sapphire Sleet, Stardust Chollima, BlueNoroff, UNC1069) Activity NPM supply chain compromise via maintainer social engineering Targets Users of the axios, debug, chalk, and typo-crypto packages Scale axios sees 100M+ weekly downloads; ~1 in 10 cloud environments hit by debug/chalk Status Vendor attribution, medium confidence; no arrests Source Amazon Threat Intelligence (CJ Moses) TL;DR Amazon has tied a string of open-source supply chain attacks to one DPRK-linked group.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter TAG-195 Upgrades MaaS Ecosystem with Modular Tools  Inside a DPRK BlueNoroff ClickFix Kit SourTrade: Browser-Assembled Malware Delivered Through Malvertising   MedusaHVNC: A Hidden Desktop That Steals Live Windows Sessions   Unpacking “Cruciferra”: An Analysis of a […]

This talk presents a technical analysis of a multi-stage macOS attack chain attributed with moderate-high confidence to the Lazarus/BlueNoroff cluster, targeting cryptocurrency users across a broad ra...

Amazon linked a series of npm supply-chain compromises involving typo-crypto, debug, chalk, and axios to the North Korean Sapphire Sleet threat actor, also known as BlueNoroff and Stardust Chollima. The campaign used social engineering, malicious package updates, and evolving stealth techniques, while Amazon also backed community defenses and the Akrites initiative. #SapphireSleet #BlueNoroff #StardustChollima #npm #axios #debug #chalk #typo-crypto #OpenSSF #Akrites

At a glance

北朝鮮のBlueNoroffは、マルウェアを仕掛ける前に、偽のZoomやTeamsの通話で暗号通貨ウォレットをスキャンしていることが、JUMPSECの調査で判明した。.

BlueNoroff uses fake Zoom and Teams meetings to profile crypto wallets, hijack Telegram accounts, and deliver Windows and macOS malware.

North Korean hacking group BlueNoroff, a subgroup under the broader Lazarus Group ecosystem, has escalated its social engineering operations across the Web3 sector. New findings from cybersecurity firm JUMPSEC reveal that the group is operating an active, highly structured phishing kit impersonating Zoom and Microsoft Teams. Rather than infecting every user who interacts with the lure, the kit selectively targets high-value cryptocurrency holders after scanning their browsers for crypto wallet extensions. How the attack works The scam starts with a message sent from a compromised Telegram account belonging to someone the victim already knows, often a trusted contact in the cryptocurrency industry. The victim receives what looks like a legitimate Calendly invitation for a Zoom meeting. But instead of taking them to Zoom, the link redirects them to a fake website hosted on a typosquatted domain that closely mimics the real video conferencing platform. The phishing page asks users to enter their name and grant webcam access. Behind the scenes, the webcam feed is quietly transmitted to the attackers. Once the victim joins the fake meeting, they see a “waiting for other participants” screen while the attackers control the session from an operator panel. The operators then send fake messages...

Hacker kapern Firmennetzwerke über falsche Meeting-Einladungen und manipulierte WLAN-Hotspots.Die Bedrohungslage für Unternehmen hat sich im Juli 2026 dramatisch verschärft. Gleich mehrere hochentwickelte Kampagnen nutzen Microsoft Teams und die Microsoft-365-Infrastruktur als Einfallstore. Besonders betroffen: Finanzinstitute und die Kryptobranche.Nordkoreanische Gruppe zielt auf Krypto-ManagerDie Hackergruppe BlueNoroff, ein Ableger der berüchtigten Lazarus-Gruppe, setzt auf eine perfide Masche: Fake-Meeting-Einladungen über […] The post Operation BlueDash: Gefälschte Updates installieren Fernwartungs-Trojaner appeared first on BornCity.

BlueNoroff uses fake Zoom and Microsoft Teams calls with AI-generated headshots to steal crypto wallets targeting 100+ victims globally including 41% in the US.

BlueNoroff hijacks Telegram accounts to send fake Zoom and Teams links, stealing crypto wallets, credentials, and funds via ClickFix.