Lazarus Is Using AI to Scale Attacks on Developers. The Numbers From Q1 2026 Show It Is Working.

In the first quarter of 2026, a North Korean threat actor subgroup tracked by Expel as HexagonalRodent compromised 2,726 developer systems, exfiltrated 26,584 cryptocurrency wallets, and extracted up to $12 million in value. The operation ran through fake recruiter outreach, backdoored coding assessments, and abuse of a VSCode configuration file that most developers have never thought to audit. It was assisted, at multiple stages, by generative AI.

Expel assesses HexagonalRodent with medium-high confidence as a subset of Famous Chollima — a DPRK-nexus cluster with a documented focus on financial theft through developer targeting. What this investigation adds to the existing picture of North Korean cyber operations is not a new actor or a novel objective. It is evidence of systematic industrialisation: the use of AI tooling to compress the time and skill required to build convincing lures, functional malware, and operational infrastructure at scale.

The Attack Chain

The initial contact is social engineering, not exploitation. HexagonalRodent approaches Web3 developers through fake recruiter personas and front-company job listings — entities built to pass surface-level scrutiny, with AI-generated websites constructed on Anima and professional profiles that present as legitimate. The targeting is deliberate: Web3 developers hold high-value cryptocurrency credentials, work in an ecosystem where informal job outreach through LinkedIn and Telegram is normalised, and are accustomed to completing coding assessments as part of hiring processes.

The assessment is the delivery mechanism. The backdoored package arrives as a take-home coding challenge — a format the target expects and considers legitimate. The malicious payload deploys through a VSCode configuration file called tasks.json, using the runOn: "folderOpen" parameter to execute automatically when the developer opens the project directory in VSCode. No macro, no prompt, no user interaction beyond opening the folder. The assessment runs. The malware runs with it.

The deployed toolkit spans three components. BeaverTail and OtterCookie are NodeJS-based. InvisibleFerret is Python-based. Together they handle credential harvesting, wallet exfiltration, and persistent command and control via WebSocket connections to attacker-controlled infrastructure. One confirmed C2 address — 195.201.104[.]53 — is also tied to a separate supply-chain compromise involving a VSCode extension, indicating shared infrastructure across distinct HexagonalRodent operations.

Why Detection Is Structurally Difficult

The toolkit is designed to blend into the environment it targets. Developers run Node and Python processes constantly. They make outbound network connections constantly. They use obfuscated code — the campaign uses obfuscator.io — in legitimate contexts. EDR products that inspect browser processes and Office macros with high fidelity have considerably less visibility into NodeJS and Python interpreter activity, which means the malware’s execution environment is one of the few spaces on a developer’s machine where behaviour-based detection is genuinely weak.

The persistent WebSocket C2 connection is the most detectable element of the chain, but only if defenders know to look for it. A Node process holding a long-lived TCP session to an unfamiliar external IP is anomalous. It is also easy to miss in an environment where developer workstations generate significant and varied outbound traffic.

The AI assistance dimension changes the operational economics of the campaign in a way that matters for how defenders should think about it. Expel’s investigation confirmed that HexagonalRodent used Cursor and ChatGPT to generate loader code, build keylogger panels, and construct the front-company websites used in the initial lure phase. This is not an actor that required specialist development capability to produce functional malware. Generative AI compressed the skill requirement and, more significantly, compressed the time required to generate new variants and new lure infrastructure. An operation that previously required weeks of preparation per campaign can now iterate faster than detection signatures can be written for it.

The Scale in Context

26,584 wallets from 2,726 developer systems in a single quarter is not an incidental finding. It is evidence of a production-scale operation with consistent methodology, reliable delivery, and repeatable results. Extrapolated across the year, the trajectory implies tens of millions of dollars in cryptocurrency theft from developer targets alone — separate from whatever access to corporate infrastructure the compromised developer machines provided beyond the wallets themselves.

The connection to the broader DPRK revenue generation programme is direct. The Lazarus Group and its subgroups have been consistently assessed as generating foreign currency for the North Korean state through cryptocurrency theft. The industrialisation of this operation through AI assistance means the programme can scale without a proportional increase in operational personnel. The bottleneck is no longer how many skilled operators DPRK can field. It is how many developers can be reached with convincing lures.

Defender Actions

The attack chain has multiple intervention points, and defenders who address only one of them are not adequately protected.

• Enforce VSCode workspace trust settings across developer environments and disable automatic task execution — tasks.json with runOn: "folderOpen" should not execute without explicit user confirmation, and this setting should be enforced at the organisational level rather than left to individual developers
• Establish a policy requiring that all take-home coding assessments, technical challenges, and externally supplied repositories are opened exclusively in disposable virtual machines or containerised environments — a compromised sandbox is contained; a compromised developer workstation is not
• Audit tasks.json files in any repository that arrives through external channels before opening the project — the presence of runOn: "folderOpen" combined with unfamiliar execution commands is the specific indicator this campaign relies on
• Hunt for Node and Python processes holding persistent TCP connections to external IPs that do not correspond to known development services — netstat -an | grep 195.201.104.53 is the starting point; the broader hunt is any long-lived outbound TCP session from an interpreter process to a non-CDN, non-registry IP
• Block or alert on outbound WebSocket connections from developer workstations to IPs not associated with known legitimate services — WebSocket persistence from a development machine to an unfamiliar host is a high-fidelity indicator in environments where this traffic is baselined
• Require hardware security tokens for high-value cryptocurrency wallets held on developer machines — credential exfiltration that captures a software wallet seed phrase is immediately actionable for the attacker; hardware token requirements make that exfiltration non-actionable regardless of what was stolen
• Treat fake recruiter outreach as a social engineering threat category requiring security awareness coverage equivalent to phishing — developers in Web3 and financial technology environments are a specifically targeted population and should be briefed accordingly
• Apply 195.201.104[.]53 and the associated VSX extension supply-chain indicators as blocking rules at the perimeter and as retrospective hunt queries across endpoint telemetry

The Forward-Looking Problem

HexagonalRodent’s use of AI to generate lure infrastructure and malware components is not an isolated tactical choice. It is a preview of how AI assistance changes the threat landscape for financially motivated nation-state actors. The barrier to producing convincing front-company websites, functional loader code, and varied lure messaging has dropped. The iteration speed has increased. The volume of campaigns that a given number of operators can sustain has grown.

The developer community is a high-value target population that occupies a trusted position in most organisations’ security models. They have elevated access, they handle sensitive credentials, and they work in an ecosystem where informal outreach and external code are normalised. That combination makes them precisely the population that a well-resourced, AI-assisted operation will continue to prioritise.

The coding assessment arrived in a folder. The developer opened it. VSCode did the rest.