North Korean Hackers’ New Crypto Job Scam: Malware Disguised as Developer Coding Challenges

In a chilling evolution of cyber deception, North Korean threat actors have unleashed a sophisticated new campaign targeting cryptocurrency developers through fake job offers. Dubbed “Graphalgo,” this operation has been quietly operating since May 2025, representing a significant escalation in the state-sponsored hacking group’s tactics.

The Perfect Deception: Fake Recruiters and Real Jobs

The attack begins with what appears to be legitimate employment opportunities. North Korean hackers create convincing fake companies in the blockchain and cryptocurrency trading sectors, then post job listings on major platforms including LinkedIn, Facebook, and Reddit. These aren’t your typical phishing attempts—the postings look authentic, complete with professional descriptions and realistic requirements.

When developers apply, they’re asked to complete a coding challenge—a standard practice in tech hiring. The twist? The coding challenge itself is weaponized.

The Malicious Payload: Hidden in Plain Sight

Here’s where the sophistication becomes apparent. The attackers don’t just send malicious code directly. Instead, they provide seemingly legitimate projects that require candidates to run, debug, and improve existing code. Embedded within these projects are dependencies hosted on legitimate package repositories like npm and PyPi.

One particularly insidious example involved a package called “bigmathutils,” which had accumulated 10,000 downloads before version 1.1.0 introduced malicious payloads. The attackers then quickly marked the package as deprecated, covering their tracks.

The Graphalgo Campaign: A Modular Monster

The campaign’s name comes from the pattern of malicious packages, many containing “graph” in their names—designed to impersonate popular libraries like graphlib. However, since December 2025, the attackers have shifted to packages with “big” in their names, expanding their reach.

ReversingLabs researchers discovered 192 malicious packages associated with this campaign. The modular nature of the operation means that even if security researchers identify and remove some packages, the attackers can quickly resume their activities using alternative packages.

Technical Deep Dive: How the Attack Works

The infection chain is meticulously crafted:

1. Initial Contact: Developers apply to fake job postings on social platforms
2. Project Assignment: Candidates receive a coding project to complete
3. Dependency Installation: The project requires installing dependencies from npm or PyPi
4. Malicious Activation: These dependencies contain hidden malicious code
5. RAT Deployment: A Remote Access Trojan (RAT) installs on the victim’s machine

The RAT is particularly concerning. It can:

• List running processes on the infected system
• Execute arbitrary commands from a command-and-control (C2) server
• Exfiltrate files
• Drop additional payloads
• Check for cryptocurrency wallet extensions like MetaMask

Attribution: The Lazarus Group Strikes Again

Security researchers attribute this campaign to the notorious Lazarus Group with “medium-to-high confidence.” Several factors point to this conclusion:

• Coding Test Infection Vector: This mirrors previous Lazarus operations
• Cryptocurrency Focus: Consistent with North Korea’s financial motivations
• Delayed Payload Activation: Demonstrates the group’s characteristic patience
• Time Zone Evidence: Git commits show GMT +9, matching North Korea time
• Multi-Language Support: RAT variants in JavaScript, Python, and VBS

The Bigger Picture: State-Sponsored Cybercrime

This campaign represents more than just another hacking attempt. It’s part of North Korea’s broader strategy to fund its regime through cybercrime. The country faces severe international sanctions, and cryptocurrency theft has become a crucial revenue stream.

The sophistication of Graphalgo—using legitimate platforms, creating convincing fake companies, and employing modular tactics—demonstrates that North Korean hackers are evolving rapidly. They’re not just opportunistic criminals; they’re strategic operators adapting to security measures.

Who’s at Risk?

While the campaign targets JavaScript and Python developers specifically, the implications are broader:

• Cryptocurrency Developers: Primary targets due to financial motivations
• Open Source Contributors: Anyone who might download packages from npm or PyPi
• Tech Job Seekers: The fake recruitment angle could expand to other sectors
• Organizations: Companies hiring developers could unknowingly introduce compromised code

Protection and Prevention

For developers who may have interacted with these malicious packages, immediate action is critical:

1. Rotate all tokens and account passwords
2. Reinstall operating systems completely
3. Audit all code dependencies
4. Verify job postings through official company channels
5. Be skeptical of unsolicited job offers, especially in crypto

Organizations should implement:

• Dependency scanning in development pipelines
• Package verification procedures
• Security awareness training for technical staff
• Multi-factor authentication everywhere possible

The Future of Supply Chain Attacks

The Graphalgo campaign highlights a disturbing trend: the weaponization of software supply chains. By targeting package repositories and exploiting the trust developers place in these platforms, attackers can reach thousands of victims through a single compromised package.

This approach is particularly effective because:

• Developers trust popular package repositories
• Code dependencies are often installed automatically
• The attack surface is massive and distributed
• Traditional security measures may not catch malicious dependencies

Conclusion: A Wake-Up Call for the Tech Industry

The Graphalgo campaign isn’t just another hacking story—it’s a stark reminder of how sophisticated state-sponsored cybercrime has become. North Korean hackers are no longer just targeting banks or exchanges directly; they’re infiltrating the development community itself, turning job seekers into unwitting accomplices.

As cryptocurrency continues to grow in value and adoption, expect these attacks to become more frequent and more sophisticated. The tech industry must respond with equally sophisticated defenses, including better package repository security, improved developer education, and more robust supply chain protection.

The question isn’t whether these attacks will continue—it’s how many more developers will fall victim before the industry fully awakens to this new reality of cyber warfare.

Tags & Viral Phrases:

• North Korean hackers
• Lazarus Group
• Fake job recruiters
• Cryptocurrency malware
• Developer coding challenges
• npm malicious packages
• PyPi supply chain attack
• Remote Access Trojan (RAT)
• MetaMask wallet stealer
• State-sponsored cybercrime
• Software supply chain attack
• Blockchain job scam
• Crypto developer targeted
• GitHub organization compromise
• North Korea sanctions evasion
• Tech industry wake-up call
• Malicious dependencies
• Recruitment phishing 2.0
• Cryptocurrency theft operation
• Developer job interview malware
• npm package compromise
• PyPi repository attack
• RAT malware campaign
• Cryptocurrency wallet targeting
• State-backed hacking group
• Software development supply chain
• Tech recruitment scam
• Blockchain developer targeting
• North Korean financial warfare
• Malicious package repositories

,