Slow fog warning: Lazarus organization attacks Web3 developers

SlowMist has issued a security warning stating that the HexagonalRodent gang, a subsidiary of the Lazarus organization in North Korea, used social engineering methods such as "high paying remote positions" and "well-known project recruitment" to induce Web3 developers to execute malicious code and steal encrypted assets. On March 9, 2026, a user with the same name as the developer of the fast draft extension was infected with the OtterCookie malware and used to distribute malicious software. Attackers also heavily use ChatGPT and Cursor to enhance camouflage and deception.