North Korean APT37 Deploys NarwhalRAT via Fake Microsoft Security Alerts

The North Korean state-sponsored hacking group ScarCruft (aka APT37) has been observed launching spear-phishing campaigns that impersonate Microsoft Account security notifications to deliver a Python-based remote access trojan called NarwhalRAT. According to the Genians Security Center (GSC), the attack email falsely warns recipients of abnormal activity tied to repeated one-time password (OTP) generation, framing it as a third-party phishing attempt against their Microsoft Account and urging an immediate password change. The message instructs the target to review an attached advisory, but the attachment is actually a ZIP archive containing a malicious LNK shortcut rather than a legitimate Hangul Word Processor document.

Once executed, the LNK file triggers a multi-stage infection chain that uses intermediary batch scripts to retrieve the legitimate Python executable from Python's official site alongside a Windows security catalog (CAT) file. Persistence is established through a scheduled task that launches the CAT file, which fetches and runs the main payload directly in memory, leaving minimal forensic artifacts on disk. NarwhalRAT is capable of keylogging, high-resolution screenshot capture, ambient audio recording, directory enumeration, active window monitoring, USB media data collection, command-and-control (C2) instruction execution, and dynamic C2 server switching. The malware stages harvested data under the hidden path "%APPDATA%\naverwhale," a deliberate masquerade as South Korean tech firm Naver Corporation's Whale browser.

This campaign marks a notable tactical shift for APT37, which has historically relied on RokRAT as its primary malware. Researchers identified that NarwhalRAT leverages compromised Korean websites, including "daehoat[.]com" and "novel21[.]co.kr," as primary C2 communication relays, while also integrating the pCloud cloud storage API as a secondary dead drop resolver using specific "folderid" and "auth" parameters. The use of legitimate cloud services for covert C2 communications highlights the group's continued investment in evasion techniques. Security professionals should remain cautious of unsolicited Microsoft account alerts—users can verify the legitimacy of suspicious messages by running their credentials through a email breach checker and ensuring account integrity via a password strength checker. For organizations investigating suspicious LNK artifacts or unfamiliar C2 domains, a WHOIS lookup can help reveal infrastructure attribution.