On April 24, SlowMist's Chief Information Security Officer 23pds tweeted that HexagonalRodent, a subgroup of the Lazarus Group, is targeting Web3 developers through social engineering tactics such as 'high-paying remote positions' and 'recruitment for well-known projects' to lure them into executing malicious code, ultimately stealing users' cryptocurrency assets. On March 9, 2026, a user with the same name as a fast-draft extension developer was infected with the OtterCookie malware, which was used to distribute malicious programs. The attackers extensively utilized ChatGPT and Cursor to assist in executing the attacks, further enhancing their disguise and deception.