Mastodawn

📢⚠️Watch as North Korean Lazarus hackers tried to infect #AllSecure CEO Chris Papathanasiou through a fake LinkedIn job interview. The attackers used a coding test loaded with the notorious #BeaverTail malware. 🦫

Read: https://hackread.com/fake-linkedin-interview-lazarus-hackers-allsecure-ceo/

#CyberSecurity #Lazarus #NorthKorea #LinkedIn #Scam

Fake LinkedIn Interview Used by Lazarus Hackers to Target AllSecure CEO

Hackread - Cybersecurity News, Data Breaches, AI and More

Mike 🇨🇦 NuanceRhymesWithOrange Feb 19

BREAKFAST OF CHAMPIONS #Photography #beavertail #ottawa

C.Feb 2

"... they wear shorts outside in February to shovel snow, and they eat beaver tails! Canadians are either really tough, or effing crazy."

#Canada #Canadian #snow #shovel #shorts #BeaverTail #misunderstanding #tough #crazy

Hackread.com Dec 18

NEW: Developers, crypto users, and job seekers beware - North Korea’s Lazarus Group is deploying a new #BeaverTail variant to steal credentials and crypto via fake job offers, dev tools and smart contracts.

Read: https://hackread.com/lazarus-embed-beavertail-variant-developer-tools/

#CyberSecurity #Lazarus #NorthKorea #DevSec #InfoStealer

Lazarus Group Embed New BeaverTail Variant in Developer Tools

The Threat Codex Oct 16

BeaverTail and OtterCookie evolve with a new Javascript module
#BeaverTail #OtterCookie #FAMOUSCHOLLIMA
https://blog.talosintelligence.com/beavertail-and-ottercookie/

BeaverTail and OtterCookie evolve with a new Javascript module

Cisco Talos has uncovered a new attack linked to Famous Chollima, a threat group aligned with North Korea (DPRK).

Cisco Talos Blog

Hackread.com Oct 16

Watch out as the North Korean hackers from the #FamousChollima group are using fake job offers to spread BeaverTail and OtterCookie malware, stealing crypto and credentials in a new attack.

Read: https://hackread.com/nk-famous-chollima-beavertail-ottercookie-malware/

#Cybersecurity #Malware #BeaverTail #OtterCookie #NorthKorea

NK’s Famous Chollima Use BeaverTail and OtterCookie Malware in Job Scam

Hackread - Latest Cybersecurity, Hacking News, Tech, AI & Crypto

CyberVeille.ch Oct 14

📢 338+ paquets npm malveillants liés à une opération nord-coréenne ciblant les devs Web3
📝 Selon Socket (Socket Threat Research Team), une opération étatique nord-coréenne en cours ar...
📖 cyberveille : https://cyberveille.ch/posts/2025-10-13-338-paquets-npm-malveillants-lies-a-une-operation-nord-coreenne-ciblant-les-devs-web3/
🌐 source : https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages
#BeaverTail #Contagious_Interview #Cyberveille

338+ paquets npm malveillants liés à une opération nord-coréenne ciblant les devs Web3

Selon Socket (Socket Threat Research Team), une opération étatique nord-coréenne en cours arme le registre npm via plus de 338 paquets malveillants totalisant plus de 50 000 téléchargements, dans une campagne « Contagious Interview » visant des développeurs Web3/crypto/blockchain via de faux recruteurs sur LinkedIn. L’attaque repose sur de leurres de recrutement qui livrent des « tests de code » contenant des dépendances typosquattées. À l’installation, des hooks npm (postinstall) déclenchent des chargeurs malveillants, conduisant à une chaîne d’infection multi‑étapes. La campagne montre une persistance industrialisée avec des envois hebdomadaires de paquets, des techniques de chargeur en évolution et 180+ faux personnages répartis sur de nouveaux comptes npm. ⚠️

CyberVeille

ESET Research Sep 25

#ESETresearch has uncovered the North Korea-aligned threat actor, DeceptiveDevelopment, targeting freelance developers with trojanized coding challenges and fake job interviews.
https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception
Victims are lured with fake job offers and asked to complete trojanized coding challenges hosted on private GitHub/GitLab repos. These projects contain obfuscated malware, often hidden in long comments outside the IDE view. The group also utilizes the ClickFix technique.
DeceptiveDevelopment’s toolset spans multiple platforms and languages: #BeaverTail (infostealer), #InvisibleFerret (modular RAT), #WeaselStore (Go/Python RAT), and #TsunamiKit (.NET spyware).
Some components, like Tropidoor and AkdoorTea, show code similarities with Lazarus-linked malware, suggesting shared tooling across these North Korea-aligned groups.
While DeceptiveDevelopment focuses on malware, OSINT shows ties to North Korean IT workers who use fake identities to secure remote jobs, thus surreptitiously funding North Korean state operations.
IoCs available in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/deceptivedevelopment

DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception

ESET researchers reveal how malware operators collaborate with covert North Korean IT workers, posing a threat to both headhunters and job seekers.

SOC Goulash Sep 21, 2025

It's been a bit quiet over the last 24 hours, but we've still got a couple of critical updates to cover, including a significant vulnerability in Microsoft Entra ID and evolving tactics from DPRK threat actors. Let's dive in:

Global Admin Access in Microsoft Entra ID ⚠️

- A critical vulnerability (CVE-2025-55241) in Microsoft Entra ID (formerly Azure AD) could have allowed an attacker to gain Global Administrator privileges in *any* company's tenant.
- The flaw stemmed from a combination of undocumented, unsigned "actor tokens" and a vulnerability in the deprecated Azure AD Graph API, enabling impersonation and bypassing Conditional Access policies.
- Crucially, exploitation left virtually no trace in the victim tenant's logs, making detection extremely difficult. Microsoft has since patched the issue and is working to remove the underlying legacy components.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/microsoft-entra-id-flaw-allowed-hijacking-any-companys-tenant/

DPRK Hackers Evolve Tactics with ClickFix and AI 📰

- North Korean threat actors, a subset of the Lazarus Group, are refining their "Contagious Interview" campaigns, now using "ClickFix" social engineering to deliver BeaverTail info-stealer and InvisibleFerret backdoor.
- A notable shift in targeting sees them focusing on marketing and trader roles in cryptocurrency and retail sectors, moving beyond their traditional software developer targets, and delivering malware as compiled binaries for multiple OS.
- These groups are actively monitoring cyber threat intelligence platforms to improve their operational resilience, with other DPRK groups like Kimsuky also leveraging GitHub for C2 and even ChatGPT to forge deepfake military IDs for spear-phishing.

📰 The Hacker News | https://thehackernews.com/2025/09/dprk-hackers-use-clickfix-to-deliver.html

#CyberSecurity #Vulnerability #Microsoft #EntraID #AzureAD #ThreatIntelligence #DPRK #NorthKorea #LazarusGroup #Malware #BeaverTail #InvisibleFerret #SocialEngineering #ClickFix #APT #InfoSec #CyberAttack

Microsoft Entra ID flaw allowed hijacking any company's tenant

A critical combination of legacy components could have allowed complete access to the Microsoft Entra ID tenant of every company in the world.

BleepingComputer

LynxIntel Sep 21, 2025

🚨 Alerte cybersécurité : Le groupe DPRK utilise ClickFix pour diffuser le malware BeaverTail via de faux sites de recrutement. Protégez-vous contre ces attaques d'ingénierie sociale sophistiquées. #Cybersécurité #Malware #DPRK #ClickFix #BeaverTail