A new malware campaign launched by the North Korean hacker group Lazarus. This attack, named “Graphalgo,” targets developers, primarily thoseworking with JavaScript and Python.
The campaign uses malicious coding tasks linked to cryptocurrency job offers to trick developers into downloading harmful software.
It has been active since May 2025 and employs several layers of deception through trusted services like GitHub, npm, and PyPI, making it hard for victims to detect.
Fake Company and Malicious Job Offers
The core of the Graphalgo campaign revolves around a fake company called “Veltrix Capital.” This company claims to be involved in blockchain and cryptocurrency trading.
However, the company’s website, created in April 2025, provides no concrete information about leadership or contact details, which is a clear red flag. The Lazarus Group used the company to create fake job offers, particularly for DevOps and other technical roles.
These job offers were spread across platforms like LinkedIn, Reddit, and Facebook, where potential candidates were approached with coding tasks designed to test their skills.
These job tasks, although appearing legitimate, are often linked to repositories on GitHub and npm. For example, developers were asked to work on projects hosted on GitHub that included seemingly harmless packages like bigmathutils and graphnetworkx.
These packages were initially safe, but once a significant number of developers downloaded them, the attackers released a malicious update that secretly installed malware on their systems.
Malicious Dependencies and the Modular Approach
What makes the Graphalgo campaign particularly effective is its modular structure. Instead of relying on a single point of failure, the threat actor uses multiple layers of deception, such as fake companies, job offers, and open-source packages.
.webp)
These layers allow Lazarus to continue the campaign even if one part is exposed or shut down.
The malware is distributed through public repositories like npm (for JavaScript) and PyPI (for Python).
The attackers use popular package names such as graphlib and networkx to make the malicious files appear legitimate. These dependencies were often bundled with the job task repositories and, once downloaded, executed the malware on victims’ machines.
Interestingly, the attackers used a strategy of patience. For example, the bigmathutils package on npm had over 10,000 downloads before the malicious version was published.
This strategy helped ensure the malware had already spread widely before the attack became apparent.
The final payload in the attack was a remote access trojan (RAT) that enabled attackers to control infected systems, exfiltrate data, and even monitor cryptocurrency wallet activities. T
he RAT communicated with a command-and-control server and could run arbitrary commands on infected systems.
.webp)
This campaign highlights the increasing sophistication of state-sponsored cyber attacks. Lazarus Group has consistently targeted developers in open-source ecosystems, and this new campaign is another reminder of the risks associated with downloading software from untrusted sources.
The use of fake job offers and cryptocurrency-focused stories is a common tactic in cyberattacks, making it crucial for developers to stay vigilant and avoid falling for such social engineering schemes.
As part of ongoing research, ReversingLabs is monitoring the situation and will continue to provide updates.
Developers are urged to be cautious of unsolicited job offers, especially those that require downloading or running coding tests from third-party repositories.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
