{"id":1327,"date":"2026-06-16T09:10:13","date_gmt":"2026-06-16T09:10:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1327"},"modified":"2026-06-16T09:10:13","modified_gmt":"2026-06-16T09:10:13","slug":"fake-microsoft-alerts-used-to-deploy-north-korean-narwhalrat-malware","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1327","title":{"rendered":"Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 16, 2026<\/span><\/span>Malware \/ Cyber Attack<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The North Korean state-sponsored hacking group known as ScarCruft<\/b> (aka APT37) has been observed using spear-phishing messages impersonating Microsoft Account security notifications to deliver malware called NarwhalRAT<\/b>.<\/p>\n

\u00abThe attack email contained a message impersonating an MS account security alert,\u00bb the Genians Security Center (GSC) said<\/a>. \u00abIt was designed to create concern over possible account compromise and OTP abuse, thereby inducing the recipient to execute the attachment.\u00bb<\/p>\n

\u00abThe email body instructed the recipient to refer to the attached advisory. However, the actual attachment was not an HWP [Hangul Word Processor] document, but a ZIP archive that contained a malicious LNK file.\u00bb<\/p>\n

The email message claims \u00ababnormal activity\u00bb related to repeated generation of one-time passwords, passing it off as a phishing attempt aimed at the target’s Microsoft Account by a third-party, and urging them to change their password. The end goal of the phishing message is to induce a false sense of urgency and deceive the victim into interpreting the email as a legitimate security alert.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The LNK file, once launched, initiates a multi-stage infection chain that employs intermediary batch scripts to download and install NarwhalRAT, along with retrieving the legitimate Python executable from the official website and a Windows security catalog (CAT) file. Persistence is achieved via a scheduled task, which is configured to launch the CAT file responsible for fetching and running the main payload in memory without leaving any artifacts on disk.<\/p>\n

<\/p>\n

The Python-based malware is equipped to log keystrokes, capture screenshots (with support for high-resolution images), record ambient audio, upload directory contents, collect active window details, gather data from USB media, execute instructions issued by a command-and-control (C2) server, and switch C2 servers.<\/p>\n

\"\"<\/a><\/div>\n

The moniker NarwhalRAT is a reference to the malware’s use of \u00ab%APPDATA%\\naverwhale\u00bb to stage the harvested information on the compromised host. The hidden directory’s name is an attempt to evade detection by masquerading as Naver Whale, a web browser developed by South Korean tech company Naver Corporation.<\/p>\n

APT37’s deployment of NarwhalRAT is noteworthy as it marks a departure from RokRAT, a malware family exclusively attributed to the hacking group.<\/p>\n

\"\"<\/a><\/div>\n

\u00abFrom a C2 infrastructure perspective, the malware uses Korean websites, including ‘daehoat[.]com’ and ‘novel21[.]co.kr,’ as primary communication relays, while also implementing communication functionality based on the pCloud cloud storage API,\u00bb the South Korean cybersecurity company said.<\/p>\n

\u00abIn particular, pCloud-specific routines that process the ‘folderid’ and ‘auth’ parameters were identified within the code. This indicates that the malware was designed to use a legitimate cloud service as a secondary C2 channel in the form of a dead drop resolver<\/a>.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Genians said the activity shares \u00abmultiple similarities\u00bb with prior Python-based attacks orchestrated by ScarCruft, including a spear-phishing campaign that has used ticket confirmation and event invites lures to trick potential targets into opening ZIP archives containing LNK files.<\/p>\n

The attack chain<\/a> plays out in a similar fashion in that the LNK file acts as a conduit for an obfuscated batch script downloaded from a remote C2 server, which then downloads the Python binary and a CAT file, ultimately resulting in the deployment of a compiled Python script capable of remote command execution and sending the results back to the C2 server.<\/p>\n

Interestingly, the scheduled task names used to set up persistence follow a similar naming convention. While the NarwhalRAT infection creates a scheduled task called \u00abMicrosoftUserInterfacePicturesUpdateTackMachine,\u00bb the second chain uses the name \u00abMicrosoftMusicLibrariesPackageTaskMachine.\u00bb<\/p>\n

\u00abOverall, NarwhalRAT is assessed to be an advanced RAT malware that integrates a Python-based multi-stage loader, an in-memory execution structure, a multi-C2 operational framework, and selective information collection functions,\u00bb Genians said.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Jun 16, 2026Malware \/ Cyber Attack The North Korean state-sponsored hacking group known as ScarCruft (aka APT37) has been observed using spear-phishing messages impersonating Microsoft Account security notifications to…<\/p>\n","protected":false},"author":1,"featured_media":1328,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[940,229,150,337,42,147,2058,247],"class_list":["post-1327","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-alerts","tag-deploy","tag-fake","tag-korean","tag-malware","tag-microsoft","tag-narwhalrat","tag-north"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1327"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1327\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1328"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}