North Korean Hackers Use NimDoor Malware, AI to Infiltrate 920 U.S. Remote IT Jobs, Stealing $16.58 Million in Crypto Sector

8 posts • GPT (4.1 mini)

Published Jul 2, 2025, 07:02 PM

North Korean operatives have infiltrated up to 920 remote IT jobs at U.S. companies, particularly targeting cryptocurrency and Web3 firms, funneling over $16.58 million to these workers since January 1, 2025. These operatives have been paid between $3,000 and $8,000 per month, averaging $2.76 million monthly. They employ sophisticated cyberattack methods including the use of novel macOS malware called NimDoor, which leverages compile-time trickery and native scripting to evade traditional security defenses.

The malware is distributed through fake Zoom invitations and phishing campaigns involving impersonation of companies like Microsoft, PayPal, and DocuSign. These tactics also include spreading malware via Nim, AppleScript, PowerShell, GitHub, and Dropbox. The FBI, Cisco, and cybersecurity firms such as SentinelOne and Microsoft have issued warnings about this rising threat, highlighting the use of AI by North Korean threat actors to enhance their capabilities. This activity represents a form of nation-state warfare within the Web3 and cryptocurrency sectors, compromising sensitive data and national security experts.

More breaking stories on DeepNewz — updated live.

#Korean #Web3 #NimDoor #Zoom #Microsoft #PayPal #DocuSign #Nim #AppleScript #PowerShell #GitHub #Dropbox #FBI #Cisco #SentinelOne #North Korean

Financial Analysis

Associated Financial Markets

More financial news and market updates→

Related Prediction Markets

Another crypto hack over $100m in 2025?

•

Sources

appleinsider.com darkreading.com thehackernews.com thenationalpulse.com

Matt Johansen

@mattjay

Microsoft just put out a detailed threat intel report on North Korean threat actors who keep getting hired for remote jobs at US companies. They also outline how they're using AI to level up. Here's some highlights:

AppleInsider

@appleinsider

North Korean hackers are using sophisticated Mac malware delivered through fake Zoom invites to break into Web3 and crypto firms, stealing sensitive data while evading standard security measures.

The Hacker News

@TheHackersNews

🚨 North Korean hackers are targeting crypto firms, Mac users, and national security experts—using fake Zoom links, job sites, and research requests. They’re spreading malware through Nim, AppleScript, PowerShell, even GitHub & Dropbox. See how it works →

Story Timeline

12 days ago•Latest version

North Korea Deploys ‘NimDoor’ Mac Malware Against Crypto Firms

12 days ago•Original version

North Korean Hackers Use NimDoor Malware, AI to Infiltrate 920 U.S. Remote IT Jobs, Stealing $16.58 Million in Crypto Sector

Image Viewer

North Korean Hackers Use NimDoor Malware, AI to Infiltrate 920 U.S. Remote IT Jobs, Stealing $16.58 Million in Crypto Sector

Financial Analysis

Associated Financial Markets

Related Prediction Markets

Another crypto hack over $100m in 2025?

Sources

Story Timeline

Similar Stories