A North Korea-linked APT group has been spotted targeting cryptocurrency startups worldwide with fake MetaMask browser extensions to steal cryptocurrency from users’ wallets. The attackers work around a complex infrastructure, including various exploits and malware implants to target victims. Organizations, especially startups, are recommended to train their employees to be careful with sensitive data and emails.