Ankura CTIX FLASH Update - July 3, 2025

Malware Activity

North Korean Malware and Sophisticated Phishing Campaigns

Cybersecurity analysts are warning of an escalating threat landscape characterized by sophisticated attacks from North Korean-aligned actors targeting Web3 and cryptocurrency sectors. These campaigns utilize advanced malware written in Nim, such as NimDoor. They employ multi-stage techniques including process injection, TLS-encrypted WebSocket channels, and innovative persistence methods via signal handlers to evade detection. The malware's deployment often involves social engineering tactics like fake Zoom updates delivered through messaging platforms. This leads to payloads that enable system reconnaissance, credential theft, and persistent remote access across macOS and other systems. Concurrently, cybercriminals are ramping up social engineering scams. Notably callback phishing (TOAD). Which use branded impersonations, QR codes, and malicious links embedded in PDFs to deceive victims