360 describes APT-C-26, also tracked as Lazarus, using Electron-packaged malicious applications against cryptocurrency users and organizations. The campaign reportedly poisoned a uniswap-sniper-bot project and delivered an installer masquerading as an automated trading tool, which then downloaded and executed malicious code to steal sensitive information. The activity aligns with Lazarus financial targeting and software supply-chain style lures against the cryptocurrency sector.