Fake Microsoft Security Alerts Used to Deploy North Korean NarwhalRAT Malware

APT37 (ScarCruft) is running an ongoing spear-phishing campaign that spoofs Microsoft security alerts to deliver a new backdoor called NarwhalRAT; the report summarizes the multi-stage infection chain, NarwhalRAT espionage capabilities, email/network/host IOCs, mitigation steps (MFA, email auth, user training, monitoring), and attribution linking the campaign to APT37 targeting governments, defense, and technology across multiple countries.