Hackers Abuse LNK Files, PowerShell, and Python Loader to Deploy NarwhalRAT

Cybersecuritynews •Tushar Subhra Dutta • June 15, 2026

A sophisticated malware campaign is quietly targeting Korean users through a well-crafted chain of deception. Threat actors are using innocent-looking shortcut files, built-in Windows tools, and a compiled Python payload to plant a remote access trojan called NarwhalRAT on victim machines. The attack stands out for how cleverly it blends into normal system activity, making […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New NarwhalRAT Malware Targets Korean Users via Phishing Emails A new malware named NarwhalRAT has been discovered targeting Korean users through phishing emails impersonating the Microsoft security team. The malware, linked to the North Korean hacking group APT37, can perform over 30 functions, including keystroke logging and remote command execution. The attack begins with a spear-phishing email warning of suspicious activity related to one-time passwords (OTPs). Users are tricked into downloading a malicious LNK file disguised as a document, which installs the malware. The malware creates a folder named 'naverwhale' to avoid detection, mimicking the Naver Whale browser. The collected data is temporarily stored before being sent to the attacker, making it harder for security solutions to detect in real-time. Security experts recommend strengthening detection systems to mitigate future attacks. 9 sources 76

Extracted Entities

Hackers Abuse LNK Files, PowerShell, and Python Loader to Deploy NarwhalRAT

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (2)