Bitdefender Labs researchers documented an active Lazarus Group campaign published on Bitdefender Labs targeting professionals via fake LinkedIn job offers for cryptocurrency exchange, travel, or financial sector projects — delivering a multi-stage, cross-platform infection chain that ultimately deploys the Tsunami Framework via Tor C2. The campaign was uncovered after attackers targeted a Bitdefender researcher, exposing the full malicious workflow from LinkedIn contact to final payload deployment.
The Lure: Fake MVP Repository and Technical Questions
The attack begins with a LinkedIn message offering a remote, part-time collaboration role on a decentralized cryptocurrency exchange or similar project. After the target expresses interest, the "recruiter" requests a CV or GitHub repository link — harvesting personal data while adding legitimacy to the interaction. The attacker then shares a repository containing the project's "minimum viable product" (MVP) along with a document containing questions that can only be answered by executing the demo code. The code appears superficially harmless but contains a heavily obfuscated JavaScript script that dynamically loads malicious code from a third-party endpoint.
Stage 1: Cross-Platform JavaScript Stealer
The initial payload is a cross-platform JavaScript info-stealer targeting Windows, macOS, and Linux. It harvests cryptocurrency wallet browser extension data (targeting a range of extension IDs), collects login data from installed browsers, and exfiltrates everything to an attacker-controlled IP address. It then downloads and executes a Python script named main99_65.py to advance the infection chain.
Stage 2: Recursive Python Stager to Three Specialized Modules
main99_65.py decompresses and decodes itself recursively through multiple layers until revealing a hidden script that downloads three additional Python modules:
- mlip.py: Hooks keyboard events targeting web browsers, monitors clipboard changes system-wide for cryptocurrency-related data, and immediately exfiltrates stolen data to a remote C2 server.
- pay.py: Reports system and network information to the attacker; searches for and exfiltrates valuable files including documents, environment variables, private keys, and cryptocurrency mnemonics; maintains a persistent C2 communication channel for additional commands and scripts.
- bow.py: Iterates over Chrome, Brave, Opera, Yandex, and Microsoft Edge; extracts and exfiltrates logins and payment data across Windows, Linux, and macOS; then runs the Tsunami Injector Python script, which connects to multiple Pastebin accounts to resolve the URL for the next-stage payload.
Stage 3: .NET Stager with Defender Exclusion, Tor Proxy, and Tsunami Deployment
The next-stage .NET binary drops additional dependencies alongside the main payload. One dependency adds malicious binaries to Microsoft Defender's exclusion list and downloads and starts a Tor Proxy Server for C2 communication. The binary downloads a further executable from the Tor C2, installs .NET 6.0 if absent, and exfiltrates victim fingerprint data including hostname, username, OS, processor name and core count, GPU name, RAM, and public IP with geolocation. The final executable downloaded from Tor runs four modules on separate threads: a Backdoor collecting browser passwords, sessions, crypto wallet keys, and Discord account secrets; a configurable Secret File Stealer scanning and exfiltrating files per server-defined rules; a configurable Crypto Miner throttled based on CPU/GPU load, core count, RAM, and ongoing user activity; and a Keylogger using Win32 APIs to capture and exfiltrate keystrokes.
Attribution and Targeting Intent
The full chain — cross-platform JavaScript stealer, recursive multi-layer Python stagers, Pastebin-based Tsunami Injector, Tor C2 communication, and the Tsunami Framework modules — is consistent with the Contagious Interview campaign attributed to Lazarus Group (APT38). Beyond personal cryptocurrency theft, the campaign's targeting of professionals in aviation, defense, and nuclear-adjacent sectors indicates a secondary objective of accessing enterprise networks for classified information, proprietary technology, and corporate credential exfiltration.