2026-04-23 · 2026-Q2
HexagonalRodent North Korean APT Industrializes Web3 Developer Attacks Using AI Coding Tools
Outside the model: Offensive use Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Unknown
- Vendor response:
- Unknown
- In the wild:
- Yes
Target
Web3 developers worldwide (subgroup of Famous Chollima/Lazarus tracked by Expel as HexagonalRodent)
Impact
2,726 developer systems infected and 26,584 cryptocurrency wallet entries exfiltrated; an estimated $12 million in crypto assets stolen during Q1 2026; victims lured by fake high-paying job postings on LinkedIn and Web3 boards that ship "skills tests" abusing VSCode `tasks.json` to auto-execute malware on project open
Root Cause
Operators with low to medium technical skill scaled malware authoring, fake company website creation, and phishing lure crafting by prompting Cursor, ChatGPT, and Anima; Cursor blocked the associated accounts and IPs; OpenAI confirmed a small number of accounts had asked for help on dual-use topics