Cryptocurrency developers and blockchain technology professionals · 11/02/2026
Researching at ReversingLabs identify a new branch of a fake recruiter campaigns conducted by the North Korean hacking team Lazarus Group. The campaign, amed graphalgo, based on the first package included in this campaign in the npm repository, has been active since the beginning of May 2025. It is a coordinated campaign targeting both Javascript and Python developers with cryptocurrency-related fake recruiter tasks. [Date Occurred: Since the beginning of May 2025; Date Discovered: Since the beginning of May 2025]
graphalgo fake recruiter campaign targets crypto developers with RAT · 2026-02-11T16:00:00.000Z
The ReversingLabs research team has identified a new branch of a fake recruiter campaign conducted by the North Korean hacking team Lazarus Group. The campaign, which the team named graphalgo, based on the first package included in this campaign in the npm repository, has been active since the beginning of May 2025. It is a coordinated campaign targeting both Javascript and Python developers with cryptocurrency-related fake recruiter tasks.
Inside the ‘graphalgo’ fake crypto developer recruitment campaign · 2026-02-12T16:00:00.000Z
Conducted by the North Korean hacking team Lazarus Group, it is a coordinated campaign targeting both Javascript and Python developers with cryptocurrency-related fake recruiter tasks, sent via social platforms like LinkedIn and Facebook, or through job offerings on forums like Reddit.