ReversingLabs blog
Graphalgo campaign (mentioned in "Malicious npm packages use fake install logs to load RAT") · 2026-03-24T15:00:00.000Z
In February 2026, for example, the ReversingLabs research team documented a North Korea connected campaign we dubbed “Graphalgo .” That campaign started in May 2025, and is part of a larger fake job recruiter scheme conducted by North Korea-backed hackers and targeting crypto developers.