North Korean hackers have once again targeted cryptocurrency developers. Security researchers discovered they planted 26 malicious packages in the npm (Node Package Manager) registry, aimed at engineers building blockchain tools and trading platforms. The goal: steal private keys, seed phrases, and secret code.
The technique is typosquatting — the malicious packages are named to resemble legitimate tools, such as ether-lint or expressjs-lint. When a developer mistakenly installs one, a hidden script triggers a Remote Access Trojan (RAT) that ransacks the system for valuable digital assets.
StegaBin Attack Chain: Steganography and Dead Drop Resolvers
Dubbed StegaBin, this campaign avoids fixed command-and-control servers. Instead, the malware uses steganography to hide instructions inside harmless-looking text. It visits Pastebin pages that appear to be technical essays, extracting specific characters at set intervals to reconstruct attacker-controlled server addresses. This bypasses scanners that rely on URL blacklists.
How Malicious Modules Steal Wallets and Credentials
Once the RAT is active, specialized modules kick in: a module called “j” targets browser extensions for wallets like MetaMask, Phantom, Coinbase Wallet, and Binance; TruffleHog scans for API keys and blockchain secrets; and a “git” module steals files from .ssh folders and scans Git repositories for login credentials, enabling lateral movement from a single developer’s machine to corporate servers.
Future Outlook: Zero Trust and Code Review Become Mandatory
The StegaBin operation underscores the need for a zero-trust software supply chain model in digital assets. With North Korean hackers intensifying crypto-targeted attacks, manual review of third-party code is no longer optional. Researchers predict future attacks will embed commands in blockchain transactions to evade detection. Companies should deploy monitoring that flags when a coding tool suddenly scans files or sends data to unknown servers.
Industry advice remains unchanged: store private keys on hardware wallets and never share seed phrases. This report is for educational purposes only.