Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware
Summary: North Korean state-sponsored group ScarCruft (APT37) sent spear-phishing emails impersonating Microsoft Account security alerts about OTP abuse, attaching a ZIP archive containing a malicious LNK file rather than the promised HWP document. The LNK file starts a multi-stage chain that downloads and installs NarwhalRAT, a Python-based remote access trojan that logs keystrokes, captures screenshots and ambient audio, and persists via a scheduled task named "MicrosoftUserInterfacePicturesUpdateTackMachine".
What you should know: NarwhalRAT stages stolen data in a hidden %APPDATA%\naverwhale directory to masquerade as the Naver Whale browser, and uses Korean websites plus the pCloud API as a secondary command-and-control channel - a state actor building detection evasion around the tools your users already trust.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026