# North Korea Cloned a CEO's Face to Hack 100M Weekly Downloads **URL:** \ **Category:** News & Articles\ **Tags:** eye-opening\ **Created:** [April 5, 2026, 1:56pm UTC](https://onehack.st/t/north-korea-cloned-a-ceos-face-to-hack-100m-weekly-downloads/320783 "2026-04-05T13:56:14Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\ **Post date:** [April 5, 2026, 1:56pm UTC](https://onehack.st/t/north-korea-cloned-a-ceos-face-to-hack-100m-weekly-downloads/320783/1 "2026-04-05T13:56:14Z")
# 🛡 North Korea Cloned a CEO’s Face to Hack 100M Weekly Downloads _A developer joined a Microsoft Teams call with what looked like real executives. It was North Korea. He installed their “audio fix.” Three hours later, 80% of the cloud was at risk._ **100 million downloads per week. 80% of cloud environments. Compromised in under 3 hours.** The axios npm package — one of the most trusted tools in JavaScript — briefly became a credential-stealing backdoor after North Korean hackers used AI deepfakes, fake Slack workspaces, and a cloned CEO to social-engineer the lead maintainer. The malicious versions were pulled Tuesday, but Google warns the “far-reaching impacts” could linger for months across infected systems. ![Hacker](https://media.giphy.com/media/RyXVu4ZW454IM/giphy.gif) > **🧩 Dumb Mode Dictionary** > > | **Term** | **Translation** | > | --- | --- | > | **npm package** | Reusable code library that JavaScript developers download instead of writing everything from scratch (like LEGO blocks for websites) | > | **Supply chain attack** | Hackers poison a trusted tool so everyone who uses it gets infected automatically | > | **Deepfake** | AI-generated video/audio that clones someone’s face and voice so convincingly you can’t tell it’s fake | > | **Two-factor authentication (2FA)** | Security layer requiring a phone code + password (the maintainer had this enabled and still got hacked) | > | **Remote access Trojan (RAT)** | Malware that gives hackers full control of your computer without you noticing | > | **Prompt cache** | Reusing previously processed AI requests to save compute costs (relevant to why this attack was expensive for Anthropic) | > **🔍 What Actually Happened** > > - **March 25, 2026** : Jason Saayman, lead maintainer of axios, receives LinkedIn message from someone claiming to be a company founder > - **Fake Slack workspace** : Hackers created branded workspace with channels, LinkedIn posts, multiple “employees” — extremely convincing > - **Microsoft Teams deepfake** : Virtual meeting featured AI-cloned face/voice of real CEO, plus fake attendees > - **The hook** : Meeting claimed Saayman’s system was “out of date” and needed a Teams component installed > - **The payload** : “Audio fix” was actually a remote access Trojan giving North Korea full system control > - **The breach** : Hackers used stolen credentials to publish malicious axios versions (15.4.0-15.4.3) > - **The spread** : In 3 hours, malware reached ~3% of scanned environments (millions of potential infection points) > - **The aftermath** : Multiple other top npm maintainers (including Socket CEO Feross Aboukhadijeh, creator of WebTorrent/StandardJS) report being targeted by identical campaign > **📊 By the Numbers** > > | **Metric** | **Value** | > | --- | --- | > | axios weekly downloads | 100 million | > | Cloud/code environments using axios | 80% | > | Time malicious versions were live | 3 hours | > | Environments infected in that window | ~3% (per Wiz scans) | > | Other maintainers targeted by same group | 30+ confirmed | > | Maintainer’s 2FA status | Enabled (didn’t matter) | > | North Korean hacker group | UNC1069 | > | Previous targets | Crypto firms, IT companies (to secure jobs) | > **💬 The Confession (From the Maintainer Himself)** > > Jason Saayman published a brutal post-mortem Thursday explaining exactly how he got fooled: > > > “They reached out masquerading as the founder of a company, they had cloned the company’s founders likeness as well as the company itself. They then invited me to a real Slack workspace. This workspace was branded… The Slack was thought out very well, they had channels where they were sharing LinkedIn posts. The LinkedIn posts I presume just went to the real company’s account, but it was super convincing etc.” > > > “The meeting had what seemed to be a group of people that were involved. The meeting said something on my system was out of date. I installed the missing item as I presumed it was something to do with Teams, and this was the remote access Trojan. Everything was extremely well coordinated, looked legit and was done in a professional manner.” > > Socket’s security team confirmed the pattern: this wasn’t a one-off. It was a **coordinated, scalable attack** targeting high-trust, high-impact open source maintainers across the Node.js ecosystem. > **🔥 Why This Is Different (And Terrifying)** > > **Most supply chain attacks exploit neglected packages.** This targeted the _most actively maintained, widely trusted_ package in the ecosystem — with a maintainer who had 2FA enabled. > > **The North Korean playbook:** > > 1. **Deep research** : Study the target’s network, company relationships, communication style > 2. **Infrastructure** : Build fake Slack workspaces, clone LinkedIn profiles, register lookalike domains > 3. **AI cloning** : Deepfake video/audio of real executives the target would trust > 4. **Manufactured urgency** : Create technical “problem” requiring immediate software install > 5. **Professionalism** : Everything polished, branded, multi-person calls — no red flags > > **What made it work:** > > - Saayman _expected_ to talk to these people (they impersonated real contacts) > - The Slack workspace looked real (channels, posts, branding, activity) > - Multiple “people” on the call added social proof > - Technical urgency (“your system is out of date”) is normal in developer culture > - Microsoft Teams glitches are common enough that an install prompt seemed reasonable > > This isn’t phishing. It’s **trust cloning at industrial scale.** #### Cool. You’re Never Trusting a Video Call Again… Now What the Hell Do We Do? ಠ\_ಠ ![Security Camera](https://media.giphy.com/media/3oEjHV0z8S7WM4MwnK/giphy.gif) > **🛡️ Verify Every Virtual Meeting (Even With 'Your Boss')** > > If someone you’ve never met IRL invites you to a call and asks you to install _anything_, treat it as hostile until proven otherwise. > > 🧠 _Example:_ A “recruiter” from Google invites you to a Teams call. Three “Googlers” are on camera. They say your browser needs a plugin to share your screen. **STOP.** Message someone you know at Google through a _different_ channel (text, LinkedIn DM, verified email) and ask “Is this real?” If you can’t verify independently, decline. > > > 📈 **Timeline:** Before accepting the meeting → 2 minutes to verify → Potentially save your entire career > **🔐 Use Hardware Security Keys for Critical Accounts** > > 2FA via SMS/app can be phished if hackers control your machine. Hardware keys (YubiKey, Titan) require physical presence and can’t be remotely stolen. > > 🧠 _Example:_ npm maintainer in Poland uses YubiKey for package publishing. Even if malware steals session cookies, attacker can’t publish without physical key tap. Package stays clean, 100M weekly users stay safe. > > > 📈 **Timeline:** $25-50 one-time cost → 10 min setup → Lifetime protection against RAT-based account takeover > **📱 Out-of-Band Verification for Unusual Requests** > > If _anyone_ asks you to install software, run a command, or share credentials in a call — verify through a completely separate channel (phone call to known number, Signal message, in-person). > > 🧠 _Example:_ Freelance developer in Argentina gets Slack message from “CTO” asking to run a script to fix staging environment. Instead of running it, she texts the CTO’s cell (saved from onboarding). CTO replies “I never sent that — report it to security immediately.” Attack stopped, credentials safe. > > > 📈 **Timeline:** 30 seconds per verification → Infinite times you don’t get supply-chain hacked > **🔍 Audit Your Dependency Tree Regularly** > > Use tools like Socket, Snyk, or npm audit to scan for malicious packages. Set up CI/CD alerts for unexpected version bumps in critical dependencies. > > 🧠 _Example:_ Startup in Vietnam runs Socket in GitHub Actions. axios auto-updates to 15.4.2 (malicious version). Socket flags “new network behavior detected” and blocks the build. Team pins to 15.3.0, dodges the breach. > > > 📈 **Timeline:** 1 hour setup → Automated scanning on every commit → Catch supply chain attacks before production > **🧠 Train Your Team on Deepfake Red Flags** > > Voice cloning is trivial now (11 seconds of audio). Video deepfakes are getting there. Establish “panic phrases” or verification questions only real colleagues would know. > > 🧠 _Example:_ Remote team in Brazil institutes policy: any call requesting credentials/installs must include answer to randomly selected personal question (“What did we eat at the offsite?”). Deepfake can’t improvise real memories. Attack fails. > > > 📈 **Timeline:** 15 min team training → Permanent cultural immune system against social engineering > **🛠️ Follow-Up Actions** > > | **Want** | **Do** | > | --- | --- | > | 🔐 Protect package publishing | Enable npm 2FA + hardware key; use `npm access` to limit collaborators | > | 🔍 Check if you’re infected | Run `npm ls axios` — if 15.4.0-15.4.3 appears, rotate all credentials immediately | > | 📧 Verify unexpected contacts | Google the sender’s domain registration date, check LinkedIn “joined” dates, reverse-image-search profile pics | > | 🛡 Harden virtual meetings | Require meeting links from known emails only; never install software suggested in first calls | > | 📱 Set up out-of-band channels | Exchange Signal numbers with key collaborators for emergency verification | **⚡ Quick Hits** | **Want** | **Do** | | --- | --- | | 🔍 Scan dependencies now | `npx socket security audit` or `npm audit` — check for axios 15.4.0-15.4.3 | | 🛡 Lock down npm account | `npm profile enable-2fa auth-and-writes` + hardware key | | 📧 Report suspicious outreach | Forward to [reportphishing@google.com](mailto:reportphishing@google.com) + your company security team | | 💬 Verify “exec” calls | Text real phone number before installing anything suggested in virtual meeting | | 🔐 Rotate credentials if exposed | Assume compromise if you ran axios 15.4.0-15.4.3 — change all API keys/passwords | _If a CEO you’ve never met asks you to install something in a Teams call, the correct answer is “let me call you back” — not “yes.”_