North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor
Blockchain and crypto developers and engineering teams (Asia-Pacific)
Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported.
Why this severity: Still active, a narrower target.
AI involvement
AI-built malware. Check Point Research describes the payload as an AI-generated PowerShell backdoor.
Check that a package, extension or app is the real one before installing it, even when an AI assistant suggested it.
- Started
- Jan 22, 2026
- Closed
- Jan 22, 2026
- Chains
- Multiple EVM chains
At risk
- Blockchain and crypto developers and engineering teams (Asia-Pacific)
- Multiple EVM chains wallets
What to do now
- Isolate any machine that ran the lure, then rotate repository, cloud and signing keys from a clean device.
- Move any wallet funds whose keys were on that machine.
Stay safe
Am I affected?
If you work on a blockchain or crypto project and opened project documents or archives from an unexpected email or chat, ask your security team to check that machine for unknown scheduled tasks and PowerShell activity.
What to do now
- Isolate any machine that ran the lure, then rotate repository, cloud and signing keys from a clean device.
- Move any wallet funds whose keys were on that machine.
How to avoid this
- Treat development machines as high-value targets: no hot wallets or production keys on them.
- Confirm unexpected documents with the sender on a second channel before opening them.
- AI lets attackers rewrite malware quickly, so rely on behaviour-based protection, not just signatures.
Timeline 1
Check Point Research published its findings on KONNI's AI-generated backdoor aimed at blockchain developers.
Source
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.