Kaspersky links Axios npm supply chain attack to North Korea’s BlueNoroff

Kaspersky's Global Research and Analysis Team (GReAT) has identified technical links between the March 2026 Axios npm supply chain attack and BlueNoroff, a subgroup of the North Korean Lazarus hacking operation known for targeting cryptocurrency and financial technology firms, according to findings published Monday.cxotoday+1

The attribution connects one of the year's most damaging software supply chain compromises to a state-sponsored threat actor with a long track record of stealing digital assets.

The Axios Attack

On March 31, 2026, attackers compromised the npm credentials of the lead maintainer of Axios, a JavaScript HTTP client with over 100 million weekly downloads, and published two malicious versions — 1.14.1 and 0.30.4. Rather than modifying the Axios source code, the attackers injected a malicious dependency called [email protected], which silently installed a cross-platform remote access trojan capable of affecting Windows, macOS, and Linux systems.unit42.paloaltonetworks+2

The exposure window lasted roughly two to three hours, but given the package's ubiquity, the blast radius was substantial. Security firm Huntress observed over a hundred affected devices in the attack's immediate aftermath. Zscaler's ThreatLabz had previously noted a North Korea attribution for the RAT dropper, and independent reverse-engineering analysis also pointed to BlueNoroff infrastructure.zscaler+2

Kaspersky GReAT's research now formalizes that link, underscoring the risks facing cryptocurrency and Web3 companies that rely heavily on open-source JavaScript tooling.itvoice+1

SilverFox Targets APAC With Fake Claude App

In a separate disclosure, Kaspersky GReAT researchers revealed that SilverFox, one of the most active advanced persistent threat groups operating in the Asia-Pacific region, has begun distributing malware through fake applications impersonating Claude, the AI assistant built by Anthropic.economictimes+1

SilverFox is known for staging multi-phase attacks using separate infrastructure at each step to avoid detection. Its most recent campaign targets organizations in industry, consulting, commerce, and transportation across India, Indonesia, South Africa, and Russia. The group previously relied on phishing emails forging tax violation notices — Kaspersky recorded more than 1,600 such emails between January and February 2026 — but has now expanded its tactics to exploit the growing adoption of AI tools across the region.news.laodong+1

Broader Implications

Both disclosures highlight how threat actors are adapting to the software ecosystem's evolving attack surface: BlueNoroff exploiting trust in open-source package registries, and SilverFox capitalizing on demand for AI productivity tools. Asia-Pacific remains the region most targeted by SilverFox, with attack volumes far exceeding those recorded in all other regions combined.news.laodong