A security researcher has uncovered a massive, 22-month-long hacking campaign by North Korean operatives that has impacted 1,640 companies across 57 countries. Vangelis Stykas, who gained access to the hackers' own servers, revealed his findings at the Black Hat security conference, noting that between 700 and 800 of the organizations suffered "really damaging" intrusions with high-level access to their internal systems.
The attackers typically targeted software developers with fake, high-paying job offers, tricking them into completing coding tests that secretly installed malware. This method allowed the hackers to steal developer credentials and breach corporate networks. Among the dozen or so companies Stykas publicly identified as impacted were cryptocurrency exchange Coinbase, Uniswap Labs, and smartphone maker OPPO. The primary motive for the campaign appears to have been financial, with a focus on stealing cryptocurrency.