PANews reported on April 24 that SlowMist issued a security alert stating that the HexagonalRodent attack group, affiliated with the North Korean Lazarus organization, is targeting Web3 developers. They are using social engineering tactics such as "high-paying remote job offers" and "recruitment for well-known projects" to induce the execution of malicious code, ultimately stealing crypto assets. On March 9, 2026, a user with the same name as the developer of the fast-draft extension was infected with the OtterCookie malware and used to distribute the malware. The attackers are extensively using ChatGPT and Cursor to assist in their attacks, further enhancing their camouflage and deception.