North Korean state-backed threat operation APT37, also known as ScarCruft, has targeted Facebook users with the RokRAT trojan as part of a new multi-stage social engineering campaign, The Hacker News reports.
The operation centered around the W3LL phishing kit, a tool sold for approximately $500 that enabled cybercriminals to create convincing fake login pages for stealing usernames and passwords.
The scam begins with a phishing email designed to appear as an official communication from the IRS, informing recipients they are eligible for a $5,000 financial grant supposedly from Elon Musk.
