North Koreans clone open source projects to plant backdoors, steal credentials

SecurityScorecard attributes a global supply-chain campaign called 'Phantom Circuit' to North Korea's Lazarus Group, in which attackers created malicious forks of legitimate open-source and cryptocurrency-related projects to deliver obfuscated backdoors that stole credentials, tokens, and system information; researchers observed multiple waves affecting hundreds–thousands of developers, identified C2 servers and an administrative platform, and documented layered obfuscation and data exfiltration to cloud storage.