HexagonalRodent Targets Web3 Developers with Social Engineering Attacks

• •HexagonalRodent is using social engineering to target Web3 developers.
• •The OtterCookie malware was used in a notable infection case on March 9, 2026.
• •Attackers are employing advanced tools like ChatGPT and Cursor to execute their schemes.

The Lazarus Group's HexagonalRodent faction is targeting Web3 developers using social engineering tactics, including fake job offers for high-paying remote positions and recruitment for well-known projects. These tactics aim to trick developers into executing malicious code, resulting in the theft of cryptocurrency assets. On March 9, 2026, a user, impersonating a fast-draft extension developer, was infected with the OtterCookie malware, which facilitated the distribution of additional malicious software. Attackers are leveraging tools like ChatGPT and Cursor to enhance their deception and impersonation efforts. The ongoing campaign poses a significant risk to Web3 developers and their assets. Security firms like Slow Fog and SlowMist have issued warnings about these attacks, highlighting the need for vigilance among developers.