North Korea-linked | Crypto

Consensys found no compromised assets or data, no malicious code deployment and no user impact, but contractor access controls face scrutiny. The post MetaMask code was open to a North Korea-linked contractor for a month before Consensys halted releases appeared first on CryptoSlate.

Mandiant, which operates under Google Cloud, has tracked the suspected North Korean scammers since 2018, and AI has helped scale up malicious attacks since November 2025. North Korea-linked threat actors are escalating social engineering campaigns targeting cryptocurrency and fintech companies, deploying new malware designed to harvest sensitive data and steal digital assets. In a recent campaign, a threat cluster tracked as UNC1069 deployed seven malware families aimed at capturing and exfiltrating victim data, according to a Tuesday report from Mandiant, a US cybersecurity company that operates under Google Cloud. The campaign relied on social engineering schemes involving compromised Telegram accounts and fake Zoom meetings with deepfake videos generated through artificial intelligence tools. Read more