North Korean hackers target Web3 developers with AI-powered attacks, stealing $12 million in three months

ChainCatcher report: According to a cybersecurity report by Expel, the company is tracking a highly assessed North Korean (DPRK) state-sponsored APT group, “HexagonalRodent,” which targets Web3 developers with the aim of stealing high-value digital assets such as cryptocurrencies and NFTs. The group primarily conducts attacks through forged job postings—publishing high-salary positions on LinkedIn and Web3 job platforms to lure applicants into completing “skill tests” embedded with malicious code, which leverages VSCode’s tasks.json functionality to automatically execute malware when victims open project folders. The malware used includes BeaverTail, OtterCookie, and InvisibleFerret, featuring capabilities such as password theft, remote control, and reverse shells. Notably, the group extensively utilizes generative AI tools like ChatGPT and Cursor to develop malware, construct fake corporate websites, and generate AI-created executive teams, even registering shell companies in Mexico to enhance the credibility of their attacks. Additionally, the group recently executed its first supply chain attack by successfully compromising a VSCode extension.