North Korean hackers are using spear phishing emails that mimic human rights organizations and financial institutions to distribute malware. This campaign, called "Operation Poseidon," is linked to the Konni hacking group and aims to exploit vulnerabilities in email security through deceptive links. Cybersecurity experts warn that these sophisticated tactics make such attacks difficult to defend against.

North Korean hackers are using Google’s Find Hub to track and factory reset Android devices of South Korean targets. They initiate attacks via spear-phishing on KakaoTalk, leading to data theft and device wipes to prevent recovery and spread malware to victims' contacts.

North Korean hackers are using malicious Microsoft Visual Studio Code projects to deliver a backdoor that allows remote code execution. By tricking victims into cloning Git repositories and opening them in VS Code, the attackers exploit task configuration files to run harmful JavaScript payloads. This ongoing campaign targets software engineers, particularly in cryptocurrency and fintech sectors.

Nearly 28% of the $1.4 billion stolen from Bybit has become untraceable, according to CEO Ben Zhou. The funds have been funneled through mixers and decentralized platforms, complicating recovery efforts. Zhou urged bounty hunters to assist in freezing stolen assets, with some success reported.

The U.S. government has seized approximately $774 million in cryptocurrency linked to North Korean cybercriminal activities. This operation is part of ongoing efforts to disrupt the funding of illicit activities supported by the North Korean regime, particularly through hacking and ransomware schemes.