Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware
ScarCruft uses fake Microsoft alerts to deliver NarwhalRAT malware to targets.
North Korean state-sponsored group ScarCruft (APT37) is deploying a new Python-based remote access trojan called NarwhalRAT via spear-phishing emails impersonating Microsoft Account security alerts. The attack uses a multi-stage infection chain starting with LNK files in ZIP archives that download batch scripts, which then retrieve the malware payload and establish persistence through scheduled tasks. The malware communicates with C2 servers using Korean websites and pCloud cloud storage as a dead drop resolver.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonScarCruft (APT37) exploited users' trust in legitimate Microsoft security communications to trick targets into executing malicious LNK files disguised as routine account alerts. The multi-stage infection chain — from ZIP archive to LNK to batch script to RAT — is designed to evade simple detection and establish durable persistence via scheduled tasks. This attack highlights how effective social engineering remains when combined with convincing impersonation of trusted brands. The use of legitimate cloud infrastructure (pCloud) as a C2 dead drop resolver further obscures malicious traffic, making detection without robust behavioral monitoring extremely difficult. Organizations that lack email authentication controls and user training are particularly vulnerable to this class of nation-state threat.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — daehoat.com
- domain — novel21.co.kr
- malware — NarwhalRAT