The Lazarus group exploited a security vulnerability in Chrome to spread spyware and steal users' cryptocurrency wallets.

In May 2024, North Korea's Lazarus hacking group launched an attack campaign under the guise of the game DeTankWar – a blockchain game using NFTs to simulate tanks. This game is a copy of DeFiTankLand and was heavily promoted on social media platforms like LinkedIn and X. Users can be infected with spyware through a zero-day security vulnerability in Chrome just by visiting the website without needing to download the game.

This vulnerability, tracked with CVE-2024-4947, allows hackers to install the Manuscrypt malware on victims' computers and steal cryptocurrency wallet credentials. On May 13, Kaspersky Labs detected and reported the attack to Google, facilitating the release of a patch on May 25. Earlier, Microsoft Security had warned about this phishing website since February 24, but hackers managed to remove the exploit code before further in-depth analysis.

Lazarus intensifies cryptocurrency attack strategy

This incident is part of the long-term strategy of North Korean hacker groups to exploit cryptocurrency. The Lazarus group gained attention by stealing over $600 million from the Ronin bridge in 2022 and laundered more than $200 million from 25 attacks between 2020 and 2023. From 2017 to 2023, North Korean hacker groups have appropriated over $3 billion from cryptocurrency platforms worldwide.

Lazarus’s exploitation of new technologies like NFTs and DeFi shows a shift in attack tactics, posing significant challenges for users and businesses. Security experts recommend regularly updating software and exercising caution when interacting with unverified blockchain services.