The “Graphalgo” Evolution: How North Korea Built a Fake Florida LLC to Hack Developers

ReversingLabs reports that the North Korea–linked 'graphalgo' campaign has escalated from phishing to a sophisticated supply‑chain and social‑engineering operation: attackers create fake recruiter profiles and LLCs, use typo‑squatted and cloned GitHub repositories with rewritten git histories, hide malicious dependencies in release artifacts and package-lock.json, and ultimately deliver a RAT to targeted developers.