A cyberattack from North Korea last Monday momentarily seized control of one of the most commonly utilized open source projects online, a process that unfolded over several weeks as part of a protracted effort to focus on the leading developers of the code.

The takeover of the Axios project on March 31 proved partially effective due to the well-funded hackers cultivating a relationship and trust with their target over an extended duration to enhance their chances of a successful infiltration. This type of breach underscores the security obstacles that creators of popular open source initiatives may encounter, especially as government hackers and cybercriminals alike are aiming at widely utilized projects for their capacity to access, in some cases, millions of devices globally.

Jason Saayman, the maintainer of the well-known Axios project that developers employ to link their applications to the internet, provided an analysis with a timeline of the breach. He revealed that the hackers initiated their targeting campaign approximately two weeks prior to ultimately taking control of his computer to disseminate malicious code.

By impersonating a legitimate company, establishing a convincing Slack workspace, and creating fake employee profiles to enhance trustworthiness, Saayman stated that the suspected North Korean hackers subsequently invited him to a web meeting that coerced him into downloading malware disguised as a necessary update to join the call. Saayman noted that the enticement mirrored a tactic often employed by North Korean hackers that misleads potential victims into permitting remote access to their systems, frequently for the purpose of stealing cryptocurrency. 

Saayman indicated that this attack mirrored previous hacks linked to North Korea by security experts at Google.

After breaching and acquiring remote control of Saayman’s machine, the hackers then deployed the malicious updates to the Axios project.

The two harmful Axios packages, removed roughly three hours after their initial release on March 31, may have still compromised thousands of systems during that interval, although the complete extent of the widespread hack remains unclear. Any computer that installed a harmful version of the software during this period may have enabled the hackers to extract private keys, credentials, and passwords from that machine, potentially leading to additional breaches.

Saayman did not quickly reply to an email inquiring about the incident.

North Korean hackers continue to be one of the most prevalent cyber threats online today, credited with the theft of at least $2 billion in cryptocurrency just in 2025.

The regime of Kim Jong Un remains under international sanctions and excluded from the global financial system due to violations related to its nuclear weapons development program, which the nation largely funds through cyberattacks and cryptocurrency theft.

It is believed that North Korea has thousands of well-organized hackers — most of whom are compelled to work against their will under the oppressive Kim regime. These hackers engage in weeks or months of intricate social engineering attacks aimed at building trust and, eventually, gaining access to steal cryptocurrency and data to extort their targets.