Reported by 1 outlet
Mastra AI Supply Chain Attack Attributed to North Korean Sapphire Sleet — Cross-Platform Stealer Targets 166 Crypto Wallets
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Mastra AI Supply Chain Attack Attributed to North Korean Sapphire Sleet — Cross-Platform Stealer Targets 166 Crypto Wallets
sonatype.com · 115d ago · June 21st, 2026
Microsoft has formally attributed the June 17 Mastra npm supply chain compromise to Sapphire Sleet (BlueNoroff), a North Korean state-sponsored threat actor specializing in cryptocurrency theft.
The second-stage payload collected host info, browser histories, installed applications, and checked for 166 cryptocurrency wallet browser extensions including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. Microsoft's investigation identified follow-on activity including a PowerShell backdoor previously tied to Sapphire Sleet, Microsoft Defender exclusion additions, and a malicious Windows service granting SYSTEM privileges.
The consistency of C2 infrastructure, persistence mechanisms, and targeting profile confirms this as an ongoing North Korean crypto-theft campaign rather than a one-off supply chain incident.