North Korean hackers exploited Chrome zero-day to steal crypto

Microsoft reported that North Korean-affiliated group Citrine Sleet exploited a previously unknown Chromium zero-day in August to target cryptocurrency organizations, using malicious websites and social engineering to lure victims and leveraging a separate Windows kernel vulnerability to install a rootkit and deploy AppleJeus malware to seize crypto assets; Google patched the Chromium flaw two days after the activity was first observed and Microsoft notified affected customers.