Slow Mist Alert: North Korean hacker group recruits and tricks Web3 developers, stealing 12 million in 3 months

A security firm SlowMist has issued an emergency alert. The North Korean Lazarus organization’s subsidiary HexagonalRodent is launching attacks against Web3 developers, using social engineering tactics such as high-paying remote positions to lure developers into executing skill assessment code that includes malicious software backdoors, ultimately stealing cryptocurrency assets. According to Expel’s investigation report, in the first three months of 2026, losses totaled $12 million.

Attack Method: Skill assessment code is the primary infection entry point

First, the attackers reach out to targets via LinkedIn or job platforms, or set up fake company websites to post job listings. They use “at-home skill assessments” as a pretext to get developers to run malicious code. The assessment code includes two infection paths:

VSCode tasks.json attack: The malicious code injects a tasks.json file containing a runOn: folderOpen directive, so that the malicious software runs automatically when the developer merely opens the code folder in VSCode.

Code-embedded backdoor: The assessment code itself embeds a backdoor. The infection is triggered when the code is executed, providing an alternate entry point for developers who do not use VSCode.

The malicious software used includes: BeaverTail (a NodeJS multi-purpose data-stealing tool), OtterCookie (a NodeJS reverse shell), and InvisibleFerret (a Python reverse shell).

First supply-chain attack: fast-draft VSX extension compromised

On March 18, 2026, HexagonalRodent launched a supply-chain attack against the VSCode extension “fast-draft,” distributing the OtterCookie malicious software through the compromised extension. SlowMist confirmed that on March 9, 2026, a user with the same name as a fast-draft extension developer was already infected with OtterCookie.

If you suspect your system has been compromised, you can use the following commands to check whether it is connected to a known C2 server (195.201.104[.]53):
MacOS/Linux: netstat -an | grep 195.201.104.53
Windows: netstat -an | findstr 195.201.104.53

Abuse of AI tools: ChatGPT and Cursor confirmed to be maliciously used

HexagonalRodent extensively uses ChatGPT and Cursor to assist attacks, including generating malicious code and building fake company websites. A key indicator of AI-generated malicious code is the heavy use of emojis in the code (extremely rare in handwritten code).

Cursor has blocked the relevant accounts and IPs within one working day; OpenAI confirmed it found limited ChatGPT usage, stating that the assistance these accounts sought falls under legitimate security dual-use scenarios, and no ongoing malicious software development activity has been found. At least 13 infected wallets’ fund flows have been confirmed to known North Korean Ethereum addresses, with payments exceeding $1.1 million received.

Frequently Asked Questions

How can Web3 developers protect themselves from this kind of attack?

Core protective measures include: (1) staying highly vigilant toward unfamiliar recruiters, especially opportunities that require completing at-home code assessments; (2) opening unfamiliar code repositories in a sandbox environment rather than the main system; (3) regularly checking the VSCode tasks.json file to confirm there are no unauthorized runOn: folderOpen tasks; (4) using hardware security keys to protect crypto wallets.

How can I confirm whether my system has been infected?

Run quick self-check commands: MacOS/Linux users run netstat -an | grep 195.201.104.53; Windows users run netstat -an | findstr 195.201.104.53. If you find a persistent connection to a known C2 server, you should immediately disconnect from the network and perform a comprehensive malware scan.

Why did HexagonalRodent choose NodeJS and Python as malicious software languages?

Web3 developers typically already have NodeJS and Python installed on their systems, so malicious processes can blend into normal developer activities without triggering alerts. These two languages are not the primary monitoring targets of traditional anti-malware systems, and combined with the use of commercial code obfuscation tools, signature-based detection becomes extremely difficult.