North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers

The article, dated 25 September 2025, reports that North Korea-linked threat actors behind the Contagious Interview campaign have been attributed to a previously undocumented backdoor called AkdoorTea, along with TsunamiKit and Tropidoor, according to ESET.

ESET researchers describe the operation as targeting software developers across Windows, Linux and macOS, particularly those involved in cryptocurrency and Web3 projects, and they list aliases such as DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, UNC5342 and Void Dokkaebi.

The campaign uses impersonated recruiters on LinkedIn, Upwork, Freelancer and Crypto Jobs List, with targets prompted to complete a video assessment or coding exercise that leads to malware delivery via GitHub cloners and deceptive websites; the operators also employ ClickFix-style tricks to address supposed camera or microphone issues.

WeaselStore and BeaverTail are cited as part of the malware family, delivering components like OtterCookie, GolangGhost (FlexibleFerret or WeaselStore) and PylangGhost, while Tropidoor has been described as a more sophisticated payload linked to Lazarus-affiliated tooling. The report notes that AkdoorTea is delivered through a Windows batch script that downloads nvidiaRelease[.]zip and a Visual Basic Script, and that past campaigns have leveraged NVIDIA driver updates as part of these attempts.