##

Recently, the North Korean hacking group Lazarus Group launched a cyberattack dubbed "Operation 99" targeting Web3 and cryptocurrency developers. The attackers posed as recruiters, enticing developers to participate in disguised project testing and code reviews through platforms like LinkedIn. They tricked victims into cloning GitLab repositories containing malicious code, which implanted modular malware into their systems. These malware possess cross-platform adaptability, enabling them to steal valuable data such as passwords, API keys, and cryptocurrency wallet information. They maintain connections through highly obfuscated command-and-control (C2) servers, maximizing their stealth. Slowmist CISO 23pds has issued a warning regarding this event, urging developers to stay vigilant and avoid becoming targets.