TechFlow News, April 24: According to a research report released by cybersecurity firm Expel, the company is tracking an advanced persistent threat (APT) group named “HexagonalRodent,” which is highly assessed to be state-sponsored by North Korea (DPRK). This group primarily targets Web3 developers and specializes in stealing high-value digital assets such as cryptocurrencies and NFTs. In the first quarter of 2026 alone, the group compromised 2,726 developer devices and stole access credentials for 26,584 cryptocurrency wallets, with the total value of stolen assets reaching up to $12 million.
The group mainly conducts its attacks via fake job postings—publishing high-paying positions on LinkedIn and Web3 recruitment platforms to lure job seekers into completing “skills assessments” embedded with malicious code. These assessments exploit VSCode’s tasks.json functionality to automatically execute malware when victims open the project folder. The malware used includes BeaverTail, OtterCookie, and InvisibleFerret, all of which possess capabilities such as password theft, remote control, and reverse shell execution.
Notably, the group extensively leverages generative AI tools—including ChatGPT and Cursor—to develop malware, build counterfeit corporate websites, and generate AI-synthesized executive teams. It has even registered a shell company in Mexico to enhance the credibility of its operations. Additionally, the group recently carried out its first-ever supply-chain attack, successfully compromising the VSCode extension “fast-draft” to distribute malware.
