The FBI attributed a record $6.43 billion Binance cryptocurrency theft to the North Korea-linked TraderTraitor group. The group has also targeted people in cybersecurity, AI, blockchain, and recruitment through fake recruiter personas and software-engineering job opportunities, aiming to persuade them to run malicious code.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A recruiter offers you a blockchain engineering interview. Then comes the coding task. TraderTraitor uses polished profiles and tailored company domains to look credible. The interview task can include a trojanized Terraform provider that runs a Bash loader. Here's the tell: the interview asks you to run their code. That provider can steal data and install a backdoor. Industry jargon isn't proof a recruiter is real. Before running any interview code, stop and get security approval through your company's usual channel.
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
The FBI attributed the theft of roughly $6.3 billion from Binance to North Korea's TraderTraitor operation, which is linked to the Lazarus Group. The reported Binance breach began with a compromised DevOps engineer laptop, while the group has previously used fake job offers and recruitment…
North Korea–linked "Jade Sleet" used job interview-style coding projects to trick developers into running malicious infrastructure code. The lure involved GitHub repositories that contained a weaponized Terraform file, leading to downloads from attacker-controlled domains and installation of macOS…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
Attackers used a compromised Rust crate maintainer account to publish new versions that secretly added a typosquatted dependency. That dependency’s build script downloaded and executed malware during compilation, meaning developers could be infected just by building a project. The attacker also…
