Fake Recruiters Spread Malware Through Coding Assignments

Imagine receiving an enticing job offer on LinkedIn or Reddit. Remote work, flexible hours, and a great salary. Everything looks professional — the company has a website, a GitHub account, and active social media profiles. But behind it all is the North Korean hacking group Lazarus, which systematically targets developers to infect their computers and steal cryptocurrency.

In February 2026, security firm ReversingLabs uncovered a new branch of this campaign codenamed “Graphalgo,” which has been active since at least May 2025 and poses a serious threat to the entire developer community due to its sophistication.

The attack principle is simple. The hackers create a fictitious company and publish job postings on platforms like LinkedIn, Reddit, or Facebook. Once a developer applies, they are asked to run, debug, and improve a given project as part of the interview process. The GitHub repositories look completely innocent and contain no obviously malicious code. The malware reaches the victim’s system indirectly — through dependencies hosted on legitimate npm and PyPI registries. Simply running a command like “npm install” is enough for the malicious package to be automatically downloaded and executed.

Researchers identified a total of 192 malicious packages linked to this campaign. Among them, the package “bigmathutils” stood out, accumulating over 10,000 downloads on npm. It was originally completely harmless. Only in version 1.1.0 did the attackers add a malicious payload, and shortly afterward marked the package as deprecated to cover their tracks.

The resulting payload is a trojan horse that allows attackers to list running processes, execute arbitrary commands, steal files, and download additional malicious software. The malware also specifically checks whether the victim has the MetaMask browser extension for cryptocurrency wallets installed, clearly revealing the financial motivation behind the entire operation. Communication with the command-and-control server (C2) is protected by a token to prevent unauthorized observers from accessing it.

Researchers found variants of this RAT written in JavaScript, Python, and VBS, indicating an intent to cover the widest possible spectrum of victims. Bitdefender, in a separate analysis, also described how the Lazarus Group deploys multi-layered malware capable of operating on Windows, macOS, and Linux, incorporating modules for keylogging, cryptocurrency mining, and systematic data theft from browsers.

European Commission Targeted by Cyberattack

In late January 2026, a wave of coordinated cyberattacks shook European institutions, exploiting two previously unknown critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM). This software is used to manage mobile devices in organizations — it controls phones and tablets, enforces security policies, and manages corporate applications.

The vulnerabilities, designated CVE-2026–1281 and CVE-2026–1340, allowed attackers to execute arbitrary code on the server remotely, completely without authentication. Both received a critical CVSS score of 9.8 out of 10.

The European Commission confirmed that on January 30, it detected an attack on its central mobile device management infrastructure. The attackers may have gained access to the names and phone numbers of some employees. Although the Commission did not explicitly name the vendor of the compromised system, the circumstances clearly point to the Ivanti EPMM platform, which was later confirmed by Dark Reading.

However, the European Commission was not the only target. On the same day, January 30, the Finnish state ICT service provider Valtori, which manages mobile devices for the entire Finnish central government, was also hit. In this case, the work data of up to 50,000 government employees was stolen.

On February 6, the Dutch State Secretary for Justice and Security informed parliament that the Dutch Data Protection Authority and the Council for the Judiciary had also been compromised. Dutch authorities were the only ones to publicly name Ivanti EPMM as the source of the compromise.

After the vulnerabilities were disclosed — and especially after security firm watchTowr published a proof-of-concept exploit — the attacks escalated dramatically. The Shadowserver organization identified more than 86 compromised servers and warned that nearly 1,300 Ivanti EPMM instances remain exposed on the internet, with unclear patching status. Rapid7 recorded hundreds of connection attempts from over 130 unique IP addresses within 24 hours on its honeypot, with 58% directly attempting to exploit the mentioned vulnerabilities. Researchers from Greynoise and Defused Cyber also uncovered a sophisticated campaign in which attackers deployed so-called “sleeping” shells on compromised servers.

The incident is reminiscent of a similar attack in 2023, when other Ivanti EPMM vulnerabilities were used to compromise the systems of twelve Norwegian government ministries, presumably by a Chinese state-sponsored group.

Notepad as an Attack Vector and a Zero-Day in Remote Desktop Services

On February 10, 2026, Microsoft released its regular Patch Tuesday security updates, this time addressing a total of 59 vulnerabilities. Among them are six actively exploited zero-day flaws. Two of the patched vulnerabilities deserve special attention.

Vulnerability CVE-2026–20841, rated CVSS 8.8 (High), turns a simple text editor into a potential entry point for attackers. The cause is improper handling of special characters when processing Markdown files. Specifically, it is a command injection flaw (CWE-77). In May 2025, Microsoft added Markdown rendering support to Notepad, including clickable links, which significantly expanded the application’s functionality — but also its attack surface. An attacker only needs to convince the victim to open a specially crafted .md file and click an embedded link. Notepad then launches an unverified protocol that downloads and executes remote code with the privileges of the logged-in user. If the user has administrator rights, the impact can be catastrophic.

The second critical flaw is CVE-2026–21533, rated CVSS 7.8, which affects the Windows Remote Desktop Services. Despite the name, this is not a remote attack but a local privilege escalation. An attacker with a regular user account and access to the system can gain SYSTEM-level privileges. The vulnerability falls under CWE-269 (Improper Privilege Management) and is actively exploited in real-world attacks.

In addition to the two flaws mentioned above, Microsoft patched four more actively exploited vulnerabilities. CVE-2026–21510 allows bypassing Windows SmartScreen protections and security dialogs through malicious shortcuts or links. CVE-2026–21513 targets the MSHTML framework, enabling the bypass of security mechanisms when processing HTML or LNK files. CVE-2026–21514 poses a similar threat in Microsoft Word, where a crafted document bypasses OLE protections. CVE-2026–21519 enables privilege escalation through the Desktop Window Manager.

Overall, the February update is dominated by privilege escalation flaws.

Gemini Exploited to Conduct Cyberattacks

The Google Threat Intelligence Group (GTIG), in collaboration with Google DeepMind, published an extensive report revealing how state-sponsored hacking groups from China, Iran, North Korea, and Russia systematically abuse the Gemini language model across all phases of cyberattacks — from reconnaissance and target profiling through crafting phishing messages to developing malicious software and data exfiltration.

The individual groups approach Gemini differently, but with a similar goal — to make their operations more efficient and faster. An Iranian group used generative AI to search for email addresses of specific individuals and organizations, to research potential business partners, and to construct credible pretexts for social engineering. A North Korean group used Gemini to synthesize information from open sources and to profile high-value targets. A Chinese group gathered detailed information about specific individuals in Pakistan and separatist organizations through AI. Another Chinese group used Gemini to automate vulnerability analysis and create testing plans targeting American targets.

The GTIG report also highlights the emergence of new threat categories associated with AI. One of them is HonestCue malware, a proof-of-concept framework discovered in late 2025 that dynamically generates malicious C# code through the Gemini API, compiles it, and executes it directly in memory, thereby evading traditional detection methods. Another example is the CoinBait phishing kit, which masquerades as a cryptocurrency exchange and whose code bears traces of generation using the Lovable AI platform. Attackers have also begun exploiting public sharing features of AI platforms like Gemini and ChatGPT to host fraudulent content and conduct so-called ClickFix campaigns, where users are lured into running malicious commands through fake advertisements in search results.

Google responded to the discovered threats by deactivating the accounts involved.