North Korean Hackers Exploit Python Projects to Target Crypto Developers

Jhade
Apr 16
2 min read

In a newly uncovered cyber-espionage campaign, the North Korean state-linked hacking group known as Slow Pisces is targeting cryptocurrency developers through deceptive job offers and malware-laden Python projects. The findings, published by Palo Alto Networks' Unit 42, highlight an increasingly dangerous trend in the exploitation of open-source platforms and professional networking sites for cyberattacks.

The attack begins with fake recruiter messages on LinkedIn, where developers are contacted under the pretense of a legitimate hiring process. Once engaged, the victims are sent a PDF outlining a coding challenge — which includes a link to a GitHub repository hosting a compromised Python project.

When the victim downloads and runs the code, two types of malware are deployed:

RN Loader: Initiates communication with a remote command-and-control server to download additional malicious payloads.
RN Stealer: Specifically designed to target macOS systems, this tool steals sensitive information including system metadata, a list of installed applications, browser-stored credentials, iCloud Keychain data, and SSH keys.

This campaign is part of a broader tactic where attackers abuse open-source ecosystems. For example, malicious Python packages like 'pytoileur' have been found on PyPI, disguised as legitimate software while secretly exfiltrating cryptocurrency-related data.

Security experts warn developers to remain cautious of unsolicited job offers—especially those that involve unfamiliar code or require downloading files from unverified sources.

“The blend of social engineering with technical malware delivery is a hallmark of advanced persistent threat actors,” said researchers at Unit 42.

To mitigate risk, developers are encouraged to:

Vet all external job inquiries carefully.
Review any code from third-party sources before execution.
Employ endpoint protection tools and network monitoring.
Keep systems and development environments up to date.

As the line between professional networking and cybercrime continues to blur, awareness and vigilance remain crucial in the defense against state-sponsored cyber threats.