Product
TestFlight
- First Reported
- Apr 5, 2026
- Latest Reported
- Apr 10, 2026
Reported Context (3)
- Sleet operation—used fabricated professional identities, Telegram communications, and likely malicious TestFlight and code-repository vectors to compromise contributors and exfiltrate funds. Drift Post-Mortem Links $280 Million Crypto Theft to North Korean-Linked Social Engineering Operation
- Attribution points to DPRK-linked group UNC4736 after a six-month infiltration involving social engineering, a malicious TestFlight app, and a VSCode/Cursor vulnerability. Drift Protocol Drained of $285M in 12-Minute Exploit; Investigators Link Operation to UNC4736
- The campaign deployed supply-chain tactics (a malicious VS Code project and a fraudulent TestFlight wallet), showed on-chain links to the Radiant Capital attackers, and aligns with a broader DPRK strategy of fragmented Drift Says $285 Million Theft Followed Six-Month DPRK-Linked Social Engineering Operation
Malware (3)
People (2)
Threat Actors (8)
Vendors (3)
Products (11)
Industries (3)
Countries (12)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.