KuCoin links recent fake-recruiter phishing against cryptocurrency-sector personnel to Lazarus Group/APT38, with lures delivered through LinkedIn, Telegram, and X. Non-technical victims are pushed through a fake interview site that claims a missing camera driver and instructs them to run macOS or Windows commands that download payloads from technudge[.]pro. The macOS chain stages files under /var/tmp/CDrivers, launches cloud.sh, opens a fake ChAudioFixer app, and installs a LaunchAgent for persistence, while the Windows chain expands cdrivWin.zip and runs update.vbs through wscript.exe. The Windows package includes Python-based components such as nvidia.py, auto.py, api.py, and command.py for cookie, saved-password, crypto-wallet theft, encrypted communication to 38.146.28[.]177:8080, and remote-control functions. Technical targets are also steered toward malicious repositories, npm packages such as matrix-charts and rtklog, and a GitLab clone flow that the article says abuses CVE-2025-48384.