Konni Hackers Deploy AI-Powered Malware in Targeted Attacks on Blockchain Engineers

Blockchain's brightest minds are now in the crosshairs. A sophisticated hacking group, identified as Konni, has launched a targeted campaign using AI-generated malware specifically designed to compromise cryptocurrency developers and engineers.

The New Attack Vector

Forget generic phishing scams. This operation leverages tailored, AI-crafted malicious code that mimics legitimate developer tools and documentation. It bypasses traditional signature-based defenses by constantly evolving its structure—a digital shapeshifter hunting for private keys, proprietary smart contract code, and backend infrastructure access.

Why Engineers? Follow the Money

The logic is brutally simple: compromise the builder, own the vault. A single engineer's credentials can provide a gateway to millions in digital assets, undisclosed project roadmaps, and the foundational code of emerging DeFi protocols. It's a high-ROI strategy in an ecosystem where a copied seed phrase is worth more than a stolen credit card number.

The Defense Gap

Security teams are scrambling. Conventional corporate cybersecurity playbooks often fail in the decentralized, open-source world of Web3. Personal devices, remote workflows, and the culture of rapid iteration create vulnerabilities that structured enterprise IT struggles to patch. The very ethos of permissionless innovation opens doors best left closed.

A Call for Pragmatic Paranoia

This isn't a theoretical threat. It's a live-fire exercise in the multi-trillion-dollar digital asset arena. The response requires a shift from passive protection to active, adversarial thinking—zero-trust architectures, hardware security keys, and air-gapped development environments are no longer optional. Your code is your fortress; every dependency could be a Trojan horse.

The ironic twist? While crypto preaches 'don't trust, verify,' the entire edifice still depends on trusting that the person writing the code hasn't been silently compromised. Maybe the most decentralized thing left is the blame when the next exploit hits. Finance, as always, finds a way to monetize vulnerability.

North Korean Konni group deploys AI-generated malware

In the report, the researchers claimed that the malware was submitted by users who found it in Japan, India, and Australia. The attack begins with the victim receiving a Discord LINK that delivers a ZIP archive containing a PDF lure and a malicious LNK shortcut file. The LNK runs an embedded PowerShell loader that extracts a DOCX document and a CAB archive that contains a PowerShell backdoor, two batch files, and a UAC bypass executable.

After the shortcut file is launched, the DOCX opens and executes a batch file included in the cabinet file. The lure DOCX document shows that the hacker wants to compromise the development environment, which could provide them with access to sensitive assets, including infrastructure, API credentials, wallet access, and finally digital asset holdings. The first batch file creates a staging directory for the backdoor and the second batch file.

In addition, it also creates an hourly scheduled task that mimics the startup task of OneDrive. The task reads an XOR-encrypted PowerShell script from disk and decrypts it for in-memory execution. After completing all these steps, it then deletes itself to wipe all the signs of an infection. The PowerShell backdoor heavily masks its origin using arithmetic-based string encoding, runtime string reconstruction, and the execution of the final logic using “Invoked-Expression.”

According to the researchers, the PowerShell malware indicates the presence of an AI-assisted development rather than traditionally authored malware. The evidence showing this includes the clear and structured documentation at the top of the script, which is very unusual for malware development. In addition, it has a clean and modular layout, and the presence of a “#

CheckPoint researchers give details on the malware

The researchers explained that the phrasing also shows that the model instructs a human user on how to customize the placeholder value. They said such comments are commonly seen in AI-generated scripts and tutorials. Before execution, the malware performs a hardware, software, and user activity check to ensure that it is not running in analysis environments. Once that is determined, it then generates a unique host ID. After that, it follows a specified path of action.

Once the backdoor is fully activated and running on the infected device, the malware contacts the command-and-control (C2) server periodically to send host metadata and polls the server at random intervals. If the C2 contains a PowerShell code, it turns into a script block and carries out its activities using background jobs. CheckPoint noted that these attacks can be attributed to the North Korean Konni threat actor based on the earlier launcher format and lure name.

In addition, the researchers claimed that aside from having the same script name overlap, there are other common elements in the execution chain structure with earlier attacks. The researchers have also published indicators of compromise associated with this recent campaign to help defenders recognize when they have been attacked by the North Korean Konni campaign so they can protect their assets.

The smartest crypto minds already read our newsletter. Want in? Join them.