Lazarus Group Targets Solana and Exodus Wallets Through Malicious npm Packages - Over 300 Downloads Already Reported
The notorious Lazarus Group has launched a sophisticated new campaign targeting cryptocurrency developers and users through compromised npm packages. According to a recent investigation by Socket Research Team, the North Korean hackers have planted six malicious packages in the npm repository, putting Solana and Exodus wallet users at significant risk.
These deceptive packages have already been downloaded more than 300 times, potentially compromising hundreds of development systems. The malware, identified as BeaverTail, is designed to:
- Steal login credentials
- Deploy persistent backdoor access
- Extract sensitive data from cryptocurrency wallets
- Specifically target browser profiles from Chrome, Brave, and Firefox
- Scan for keychain data on macOS systems
Security researchers identified the following typosquatted packages that developers might accidentally install: is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator.
"The stolen data is then transmitted to a hardcoded C2 server at hxxp://172.86.84[.]38:1224/uploads, following Lazarus's well-documented strategy for collecting and transmitting compromised information," explains Kirill Boychenko, a threat analyst at Socket Security.
This isn't the first time Lazarus has utilized supply chain attacks. The group previously exploited npm, GitHub, and PyPI repositories to penetrate networks, contributing to major breaches like the $1.5 billion Bybit exchange heist. Cybersecurity experts note that the group's tactics align with past campaigns that use multi-stage payloads to maintain long-term access.
In late February, North Korean hackers attacked Bybit, one of the largest cryptocurrency exchanges, stealing approximately $1.46 billion in cryptocurrency in a highly sophisticated heist. The attack reportedly occurred by compromising an employee computer at Safe, Bybit's technology provider. Less than two weeks after the breach, Bybit CEO Ben Zhou stated that about 20% of the stolen funds had become untraceable due to the hackers' use of mixing services.
What do you think? Has the crypto industry done enough to protect against state-sponsored attacks? Share your thoughts in the comments!
Are you regularly checking your crypto wallets for suspicious activity? What additional security measures have you implemented to protect your digital assets?
#CryptoSecurity #LazarusGroup #WalletSafety #SolanaHack #CyberThreats
0 Comments