North Korean hackers seized control of Axios packages, exposing thousands to risk

A targeted social engineering campaign allowed attackers to insert malicious Axios packages, potentially exposing private keys and credentials, while investigators still assess the full scope.

Based on data from Techcrunch

North Korean cyber actors have again drawn the attention of global experts: last week one of the web’s most popular open-source projects, Axios, was temporarily taken over as part of a long-running campaign against the leading developers of this software. Predictably, the planning and execution of the attack stretched over weeks.

The attackers managed to achieve partial success thanks to sustained social engineering: over an extended period they built trust with the target, increasing the chances of a breach. Such an approach underscores the serious security risks for developers of popular open-source projects at a time when government cyber operations and criminals can focus on mass-market tools with millions of users.

Jason Saayman, who covers Axios, provided a breakdown of the incident with a timeline. According to him, the attackers began the targeted campaign two weeks before they managed to gain control of the target’s computer and launch the malicious code.

To mislead, they created the appearance of a real company: using fake profiles and a fabricated Slack environment, the hackers invited Saayman to an online meeting that would lead to downloading a malicious update of purported importance. According to Saayman, this method replicated techniques usually employed by cybercriminals in the region to gain remote access and steal resources and cryptocurrency.

Investigators estimate that the attack mirrored earlier breaches linked to actions by North Korea, documented by Google researchers.

After compromising and gaining remote access to Saayman’s computer, the hackers released two malicious Axios packages. Both were taken down roughly three hours after publication, but in that window they could have infected thousands of systems. The full scale of the threat remains under investigation: any device on which the malicious version of the software was installed could become a gateway to private keys, credentials, and passwords, opening doors to further breaches.

Saayman did not respond to questions the incident.

Statements cyber threats from North Korea remain part of a global discussion: in 2025 they were implicated in billion-dollar cryptocurrency thefts. The Kim regime continues to exist under international sanctions and bans on financial transactions, and cyber threats are viewed as tools for financing and pressure on the global community.

Experts believe thousands of well-organized hackers operate beyond the regime’s borders, many working under pressure or against their will. They spend weeks or months on advanced social-engineering attacks to gain trust and access to systems for data theft and ransom extortion.

TechCrunch founder and cybersecurity editor Zack Whittaker is known as the author of a weekly cybersecurity . It is important for his colleagues and audience to track such events and respond to new threats arising in the digital landscape.