The North Korean Lazarus Group of hackers used a fake blockchain-based game to exploit a zero-day vulnerability in Google’s Chrome browser and install spyware that stole wallet credentials. Kaspersky Labs analysts noticed the exploit in May and reported it to Google, which has fixed it.

Play at a big risk

The hacker’s play-to-earn multiplayer online battle arena game was fully playable and had been promoted on LinkedIn and X. The game was called DeTankZone or DeTankWar and used non-fungible tokens (NFTs) as tanks in a worldwide competition.

Users were infected from the website, even if they did not download the game. The hackers modeled the game on the existing DeFiTankLand.

The hackers  used  malware called Manuscrypt followed by a previously unknown “type confusion bug in the V8 JavaScript engine.” It was the seventh zero-day vulnerability found in Chrome in 2024 through mid-May.

Kaspersky principal security expert Boris Larin said:

“The significant effort invested in this campaign suggests they had ambitious plans, and the actual impact could be much broader, potentially affecting users and businesses worldwide.”

The fake game was  noticed  by Microsoft Security in February. The hackers had removed the exploit from the website before Kaspersky could analyze it. The lab informed Google of it anyway and Google fixed the vulnerability in Chrome before the hackers could use it again.

Screenshot from Lazarus Group’s fake game. Source: SecureList

Related:  FBI flags 6 Bitcoin wallets linked to North Korea, urges vigilance in crypto firms

North Korea loves crypto

Zero-day vulnerabilities take the vendor by surprise and there is no patch ready for it. Thus, it took Google 12 days to patch the vulnerability in question.

Another zero-day vulnerability in Chrome  was harnessed by another  North Korean hacker group to target crypto holders earlier this year.

Source: Microsoft Threat Intelligence

Lazarus Group is fond of crypto. Between 2020 and 2023, it  laundered over $200 million  in crypto from 25 hacks, according to crypto crime watcher ZachXBT.

Lazarus Group was also alleged by the United States Treasury Department  to be behind the attack on  Ronin Bridge that netted crypto worth over $600 million in 2022. 

US cybersecurity firm Recorded Future found that North Korean hackers as a whole  stole over $3 billion in crypto  between 2017 and 2023.

Magazine:  Lazarus Group’s favorite exploit revealed — Crypto hacks analysis