Cybersecuritynews

Lazarus Group's Graphalgo Campaign Targets Developers with Malware via Fake Job Offers

First seen 12 Feb 2026, 17:28 UTC • Gbhackers

+2 •40.4

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Lazarus Group, a North Korean hacking team, has initiated a fake recruiter campaign named 'Graphalgo' targeting cryptocurrency developers. Active since May 2025, this operation utilizes fraudulent job offers to distribute remote access trojans through platforms like GitHub, npm, and PyPI, affecting developers in the blockchain and cryptocurrency sectors.

How this analysis works

Timeline

2025-05-01

Lazarus Group's Graphalgo campaign begins

2026-02-12

Cybersecurity news articles published on the campaign

Attack Flow

8 entities, 7 inferred relationships (STIX 2.1).

Threat Actor (1)

Lazarus Group

Technique (2)

Malware
Trojan

Campaign (2)

Graphalgo
Graphalgo Malware Campaign

Affected Platform (2)

GitHub
PyPI

Tool (1)

Relationships

Lazarus Group uses Npm
Lazarus Group uses Malware
Lazarus Group uses Trojan
Graphalgo attributed to Lazarus Group
Graphalgo Malware Campaign attributed to Lazarus Group
Lazarus Group related to GitHub
Lazarus Group related to PyPI

Continue Reading

Lazarus Group Exploits Windows Zero-Day to Target Defense Sector Lazarus Group Escalates Attacks with Fileless RemotePE Trojan Targeting Crypto and Banks MuddyWater Targets U.S. Entities Amid Geopolitical Tensions Ripple Shares North Korean Threat Intelligence to Combat Evolving Cyber Attacks Kelp DAO and Aave Resume Operations After $292 Million Exploit North Korean Hackers Target Open Source Software Supply Chain via npm Packages

Lazarus Group's Graphalgo Campaign Targets Developers with Malware via Fake Job Offers

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading