AhnLab: Lazarus to Use AI-Enhanced Spear Phishing in 2026, Heightening Crypto Exchange Risk

AhnLab’s 2026 security outlook warns that North Korea–linked Lazarus Group will escalate spear-phishing campaigns targeting cryptocurrency platforms and traders, now augmented by AI to produce more convincing emails, deepfakes and evasive malware. Between Oct 2024 and Sep 2025 Lazarus was cited in 31 post-incident analyses and is connected to over $1.43 billion in crypto thefts in the past year, including a $1.4 billion Bybit exploit (21 Feb 2025) and a $30 million Upbit exploit. Tactics focus on personalized lures (fake lecture invites, interview requests) to install malware, harvest credentials or obtain system access. AhnLab and other vendors (Kaspersky) say AI will enable automated phishing content, realistic voice/video deepfakes and polymorphic code that can better evade detection in 2026, increasing success rates and lowering attacker effort. Recommended mitigations for crypto firms and traders: adopt multi-layered defenses (MFA/biometric authentication), zero-trust and least-privilege access, regular patching and security audits, VPN use, robust anomaly detection, staff phishing training, verify requests via independent channels, and avoid unverified attachments or downloads. Traders should harden account access, verify communications outside email, and treat suspicious events as potentially irreversible to reduce exposure to large, permanent losses.