Cybersecurity researchers have uncovered a sophisticated cyber campaign linked to North Korean threat actors, combining AI-generated malicious code, fake corporate identities, and advanced malware to compromise developers, particularly in the Web3 and cryptocurrency ecosystem.
The operation, tracked as PromptMink, has been attributed to Famous Chollima, also known as Shifty Corsair, a group previously associated with long-running cyber espionage and fraud campaigns.
Malicious npm Package Hidden in AI-Generated Code
At the center of the campaign is a malicious npm package named “@validate-sdk/v2,” disguised as a legitimate development toolkit. While it appears to offer common features like hashing and validation, its real purpose is to extract sensitive data from infected systems.
Researchers found evidence suggesting the package was generated or modified using AI tools, including outputs linked to Anthropic’s Claude Opus model. The malicious dependency was inserted into an AI-driven project, enabling attackers to infiltrate environments through trusted automation workflows.
Layered Supply Chain Attack Strategy
The attack employs a multi-layered dependency structure:
- Initial packages appear clean and legitimate
- Hidden secondary dependencies carry malicious payloads
- Malicious components can be replaced quickly if detected
This layered design helps attackers evade detection while maintaining persistence within the npm ecosystem.
Some of the packages used in the initial layer mimic legitimate cryptocurrency-related libraries, increasing their credibility and likelihood of being installed.
Targeting Cryptocurrency and Developer Secrets
Once executed, the malware focuses on stealing high-value data, including:
- Cryptocurrency wallet credentials
- API keys and authentication tokens
- Sensitive configuration files such as
.envand.json
The stolen data is then transmitted to attacker-controlled servers, enabling unauthorized access to financial assets and development environments.
Evolution of Malware Capabilities
Over time, the malware has evolved significantly:
- Early versions used obfuscated JavaScript to steal data
- Later versions adopted Node.js executable formats
- Recent variants utilize Rust-based components for improved performance and stealth
This progression reflects a shift toward more advanced and scalable attack techniques.
Expansion to Multiple Platforms
The campaign has expanded beyond npm to include other ecosystems such as PyPI, demonstrating its cross-platform nature. The malware is capable of targeting systems running Windows, Linux, and macOS.
It also includes features such as SSH backdoor installation and full project data exfiltration, enabling attackers to gain persistent access and steal intellectual property.
Use of RATs and Advanced Payloads
In addition to data theft, the campaign deploys Remote Access Trojans (RATs) with extensive capabilities:
- Capturing screenshots
- Logging keystrokes
- Monitoring clipboard activity
- Extracting browser credentials
- Enabling remote control of infected systems
These capabilities allow attackers to maintain long-term access and control over compromised machines.
Abuse of Trusted Platforms
The attackers heavily rely on trusted platforms such as GitHub to distribute malicious content. In some cases, dependencies are hosted as release artifacts instead of being published directly to npm, reducing the chance of detection.
This technique allows malicious packages to remain hidden within deep dependency chains.
Fake Companies and Social Engineering Tactics
A parallel campaign, known as Graphalgo, uses fake companies to lure developers through job offers and technical assessments.
The attackers create convincing profiles on platforms like GitHub and LinkedIn, presenting themselves as legitimate organizations. Victims are asked to complete coding tasks that include hidden malicious dependencies, ultimately leading to system compromise.
Some of the fake companies identified include:
- Veltrix Capital
- Blockmerce
- Bridgers Finance
In one case, attackers even registered a real company in the United States to enhance credibility.
Emerging Attack Variants
Researchers have also identified new attack patterns, including:
- Multi-stage “Matryoshka” style malware delivery
- Malicious npm packages acting as droppers for secondary payloads
- Compromised popular libraries used to distribute malware
Additionally, activity linked to another North Korean cluster has targeted widely used packages, further emphasizing the scale of the threat.
Found this article interesting? Follow us on X (Twitter) , Facebook, Blue sky and LinkedIn to read more exclusive content we post.
