Microsoft shows dormant neurons can hide AI malware triggers
Editing fewer than 10 neurons can make a triggered agent emit a command that downloads and runs code.
Stories per day · 30 days
2 RSS
Relatednorth-korea12binance9south-korea5supply-chain4crossweb-ex3social-engineering3spearphishing3tradertraitor3ai-agents2crypto-theft2malware2ml-kem2model-backdoor2php2post-quantum2ai-governance1apt1campaign1
28 stories, newest first · one card per story
Stories tagged #lazarus
Lazarus and DeceptiveDevelopment target drones and software supply chains
ESET says April–September 2026 activity used fake job offers, then spread malware through stolen developer accounts and public packages.
Binance Heist Exposes AI Governance and Security Failures
Attackers stole $6.34 billion from Binance using malware on developer machines and an internal AI tool to pivot to additional systems.
1
North Korean hackers used fake job interview to breach Binance
Binance engineer downloaded malware during fake job interview, enabling $6.3B theft via social engineering and AI tooling.
3
Binance loses $6.3 billion in fake job interview malware attack
North Korean hackers used fake job interviews to install custom malware and steal $6.34 billion from Binance's wallet infrastructure.
1
Binance hack exposes $6.34 billion theft
Binance attributes $6.34 billion theft to North Korea-linked Lazarus Group using fake job interviews and AI abuse.
Compromised DevOps laptop caused $6.3B Binance breach
Binance covers all losses from North Korean-linked attack on employee device that enabled unauthorized withdrawals.
1
FBI blames North Korean hackers for $6.3 billion Binance crypto heist
The FBI has attributed the $6.3 billion Binance hack to North Korean Lazarus Group hackers, with $2.85 billion frozen.
FBI blames North Korea for $6 billion Binance crypto theft
On October 29 attackers moved about $6.36 billion from Binance wallets; issuers later froze part of the funds.
1
Binance ties roughly $6.3 billion crypto theft to a laptop
TRM and Chainalysis blame North Korea's TraderTraitor, while Binance says it has not identified who is responsible and will cover losses.
1
Binance links $6.3 billion crypto theft to compromised laptop
TRM and Chainalysis attribute the October 29 theft to North Korea’s TraderTraitor; Binance has not named a culprit.
2
ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole
Kaspersky says at least three South Korean firms were targeted since July 2025 via spear-phishing and in-memory loaders.
1
Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
Lazarus uses ML-KEM-1024 to hide payloads in Operation FlashHole
Securelist says at least three South Korean organizations were hit, with the earliest evidence in July 2025.
4
Lazarus hid FlashHole malware traffic with post-quantum keys
Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.
2
Lazarus uses ML-KEM to deliver malware in FlashHole attacks
Kaspersky says phishing led to in-memory loaders and the Cubridge backdoor at South Korean firms, starting in July 2025.
Lazarus Operation FlashHole targets South Korean organizations
Kaspersky links at least three firms in three sectors, with earliest evidence in July 2025.
6
North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors
North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.
1
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
DPRK TraderTraitor's FLATROOF and ROOFDECK macOS backdoors resurfaced on an Indian IT services victim, delivered via weaponized Terraform lock files in fake job interviews.
North Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters
Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.
3
Risky Bulletin: Expired cards can be used for new transactions
Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.
2