DPRK malware reads its C2 address from Ethereum transfers - blocking the IP is not enough. https://intel.threadlinqs.com/threat/TL-2026-2782 #ThreatIntel #DEVPOPPERjs #OmniStealer #XCTDH
@threadlinqs.bsky.social
@threadlinqs.bsky.socialDPRK malware reads its C2 address from Ethereum transfers - blocking the IP is not enough. https://intel.threadlinqs.com/threat/TL-2026-2782 #ThreatIntel #DEVPOPPERjs #OmniStealer #XCTDH
@lazarusholic.bsky.social"XCTDH Adopts Hash Hiding" published by RansomISAC. #OmniStealer, #NullReceiver, #HashHiding https://ransom-isac.org/blog/xctdh-adopts-hash-hiding
@threadlinqs.bsky.socialA stolen GitHub login turned npm's trusted-publishing pipeline into a self-deleting RAT delivery chain. https://intel.threadlinqs.com/threat/TL-2026-2605 #ThreatIntel #BeaverTail #OmniStealer #DEVPOPPER
