Lazarus Group Is Exploiting CVE-2025-48384 in New Phishing Campaign

Lazarus Group is exploiting CVE-2025-48384 in a new phishing campaign, according to KuCoin’s security team, which identifies fresh operations from the North Korean state‑sponsored threat actor (APT38) targeting financial institutions and cryptocurrency businesses.

The campaigns blend fake job interviews, poisoned code repositories, and the newly disclosed vulnerability into one of the group’s most complex efforts to date, with initial lure on platforms such as LinkedIn, Telegram, or Twitter (X) where attackers pose as recruiters.

Victims are led through a fake interview process intended to install malware that steals credentials from devices and browsers and drains crypto wallets; non-technical victims are told a “camera driver is missing” during a video interview and are instructed to run malicious commands.

Trading targets have seen macOS victims prompted to download a cdrivMac[.]sh script, while Windows victims download cdrivWin[.]zip containing update.vbs and a disguised Python interpreter (csshost.exe) that runs nvidia.py for credential and crypto theft, with persistence via registry startup keys. KuCoin notes continued use of trusted infrastructure such as api.jz-aws[.]info, dropbox[.]com for data exfiltration, and IP checks via api.ipify[.]org.