[bluenoroff]

July 30, 2026

• DPRK's BlueNoroff is now linked to the axios, debug, chalk and typo-crypto npm compromises, per new analysis tying the campaigns to a single threat actor. blackorbird · Threat Activity

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 28, 2026

• JUMPSEC dissected a BlueNoroff (DPRK/Lazarus) ClickFix malware kit that abuses hijacked Telegram accounts and fake meetings to target high-value victims, deploying sophisticated Windows and macOS payloads over infrastructure tied to Cloudzy/RouterHosting (JUMPSEC). · Threat Activity

in Agentic AI Muscles Into the Offensive Toolkit

July 25, 2026

• BlueNoroff Zoom phishing kit profiles crypto wallets. The North Korean crew's typosquatted Zoom/Teams ClickFix operation runs an active kit that fingerprints wallets before deciding on malware delivery. The Hacker News. · Threat Activity

in A Default-Config RCE Cracks GitLab, and the PoC Is Already Public