AhnLab: Lazarus spear‑phishing linked to $1.4B Bybit heist, AI to boost phishing in 2026

Cybersecurity firm AhnLab reports that North Korea‑linked Lazarus Group used targeted spear‑phishing over the past year to steal crypto credentials, deploy malware and enable large thefts — including an estimated $1.4 billion incident tied to Bybit and other breaches such as a $30 million Upbit loss. Attackers posed as lecturers, interviewers or other trusted contacts to trick victims into running malicious code or surrendering credentials. AhnLab found Lazarus referenced in 31 post‑incident analyses from Oct 2024–Sep 2025 and attributes over $1.43 billion in crypto thefts to the group in that period. The firm warns that in 2026 attackers will increasingly leverage AI — including deepfakes, automated phishing content and polymorphic malware — to make spear‑phishing more convincing and to evade detection. Recommended mitigations for exchanges, custodians and traders include multi‑layered defenses: regular audits and patching, staff phishing training, multifactor and biometric authentication, VPNs, cautious handling of links/attachments, stronger anomaly detection, and verifying communications through independent channels. For traders, immediate actions are: harden account access (MFA, hardware keys), reduce custodial risk where possible, verify any unusual requests off‑channel, and monitor counterparty health — since successful breaches can cause short‑term liquidity shocks or volatility around affected venues.