Researchers from Kaspersky’s Global Research and Analysis Team (GReAT) uncovered technical links between the headline-grabbing supply chain attack on Axios, one of the world’s most widely used JavaScript libraries, and previously documented campaigns associated with BlueNoroff, a financially motivated subgroup of the infamous Lazarus Group.
Axios is one of the most widely used JavaScript HTTP client libraries, with over 100 million weekly downloads on npm. In March 2026, attackers compromised the npm account of a lead Axios maintainer and used it to publish malicious versions of the package.
These versions introduced a hidden dependency called plain-crypto-js, which was not used by the library itself but executed during installation via a postinstall script. This dependency downloaded and deployed a cross-platform Remote Access Trojan targeting macOS, Windows, and Linux systems.
BlueNoroff is a financially motivated subgroup of the Lazarus Group, known for targeting financial institutions and cryptocurrency platforms. The group has a long history of conducting sophisticated attacks aimed at stealing funds, often using social engineering and custom malware.
“During our analysis of the Axios supply chain attack, we identified technical overlaps with two previously documented campaigns of Bluenoroff: GhostCall and GhostHire,” says Mr. Sergey Lozhkin, Kaspersky’s Head of GReAT for APAC and META regions.
GhostCall and GhostHire are two BlueNoroff campaigns targeting high-value individuals in the crypto industry. While GhostCall uses sophisticated social engineering to target executives, GhostHire disguises malware as job opportunities and coding tests aimed at blockchain developers.
The overlaps include similarities in the user agent, the use of the distinctive module name string “webT”, and the targeting of Linux, macOS and Windows within a single attack. Kaspersky GReAT researchers also identified a new version of the SyphonV2 loader, as well as overlaps in the infrastructure used across the campaigns.
“These similarities provide indicators of a possible connection to BlueNoroff, although technical overlaps alone do not constitute definitive attribution. Threat actors can reuse malware components, infrastructure and techniques, while attackers may also deliberately adopt characteristics from other campaigns to obscure their identity,” he explains.
Based on Kaspersky’s researches, BlueNoroff has a global targeting footprint, with its recent GhostCall and GhostHire campaigns eyeing Web3 and cryptocurrency organisations in India, Turkey, Australia and other countries across Europe and Asia.
To stay protected from attacks such as GhostCall and GhostHire, organisations are advised to follow these best practices:
- Consider the possibility that a trusted contact’s account may be compromised. Verify identities through alternative channels before opening any files and links, always ensuring you are on an official domain. Avoid running unverified scripts or commands to resolve issues.
- To protect the company against a wide range of threats, use solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, investigation and the response capabilities of EDR and XDR for organisations of any size and industry. Depending on your current needs and available resources, you can choose the most relevant product tier and easily migrate to another one if your cybersecurity requirements are changing.
- Adopt managed security services by Kaspersky such as Compromise Assessment, Managed Detection and Response (MDR) and / or Incident Response, covering the entire incident management cycle – from threat identification to continuous protection and remediation. They help to protect against evasive cyberattacks, investigate incidents and provide additional expertise even if a company lacks cybersecurity workers.
- Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organisation. The latest Kaspersky Threat Intelligence will provide them with rich and meaningful context across the entire incident management cycle and helps them identify cyber risks in a timely manner.
If you have an interesting Article / Report/case study to share, please get in touch with us at editors@roymediative.com roy@roymediative.com, 9811346846/9625243429
