North Korean hackers believed to be part of state-sponsored group Lazarus are reportedly targeting blockchain engineers’ Apple devices with advanced malware named Kandykorn to steal cryptocurrency. The attackers pose as a crypto arbitrage bot in a Python app delivered via a popular public Discord server. The hackers are then able to access and exfiltrate data. The campaign began in April and remains ongoing, according to cybersecurity firm Elastic Security Labs.
Who is the Kimwolf Botmaster “Dort”?
In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to build Kimwolf, the world’s largest and most disruptive
