NETSCOUT ASERT described STOLEN PENCIL as an APT campaign, possibly originating from DPRK, that had targeted academic institutions since at least May 2018. Victims received spear-phishing emails linking to actor-controlled sites that displayed lure documents and pushed a malicious Chrome Web Store extension presented as a “Font Manager,” with phishing infrastructure including domains such as client-message.com and North Korea-themed subdomains. After compromise, the operators focused on credential harvesting from browsers, process memory, network sniffing, and keyloggers, and in some cases set email forwarding while using RDP and built-in Windows tools for hands-on access rather than a conventional RAT. The report highlights academia-focused targeting, biomedical-engineering victim expertise, Korean-language OPSEC traces, malicious extension permissions over all browser URLs, and PE tools for keylogging, cryptojacking wallet replacement, administrator-account creation, and RDP enablement.