Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware

**Executive summary:** Genians and other analysts observed ScarCruft (APT37) using Microsoft Account-themed spear-phishing emails containing ZIPs with malicious LNK files to deploy NarwhalRAT, a Python-based multi-stage RAT that executes in memory, achieves persistence via scheduled tasks, uses Korean websites and pCloud as multi-C2 channels, and collects keystrokes, screenshots, audio, USB and directory data for remote exfiltration.