SlowMist CISO: Fake job postings by Graphalgo are exploiting remote access trojans to attack crypto developers.

According to Foresight News , 23pds, Chief Information Security Officer of SlowMist, tweeted that a new branch of the fake job posting campaign launched by the North Korean hacking group Lazarus Group, graphalgo, is using a remote access trojan to attack cryptocurrency developers. Named graphalgo after the first related package in the npm repository, the campaign has been active since early May 2025. This coordinated operation uses fake cryptocurrency-related job postings as bait, targeting both JavaScript and Python developers. The campaign includes the malicious npm package bigmathutils, whose original harmless version was downloaded over 10,000 times after its release, while a second version containing a malicious payload was released subsequently.