ScarCruft Uses Fake Microsoft Alerts to Drop Python RAT

North Korea's APT37, the group better known as ScarCruft, has been caught running a spear-phishing campaign built on one of the oldest pretexts going: a fake Microsoft Account security warning. According to South Korean firm Genians Security Center, the emails claim suspicious one-time password activity on the recipient's account and urge them to read an attached advisory before changing their password. It is standard stuff, engineered to spike just enough panic that the attachment gets opened without much thought.

The attachment is not the Hangul Word Processor document the email implies. It is a ZIP file with a malicious LNK shortcut tucked inside.

The infection chain

Opening the shortcut kicks off a multi-stage chain. Batch scripts quietly pull down the legitimate Python interpreter from python.org, along with a Windows security catalog (CAT) file. A scheduled task is set up to keep the operation running across reboots, with a name designed to look at home in Task Scheduler: MicrosoftUserInterfacePicturesUpdateTackMachine. The final payload runs in memory, which leaves very little for a forensic examiner to pick over later.

Meet NarwhalRAT

The payload is a Python-based remote access tool that researchers are calling NarwhalRAT. It is a generous toolkit:

• Keystroke logging
• High-resolution screenshot capture
• Audio recording
• Directory listings and USB contents collection
• The ability to swap between command-and-control servers on the fly

Stolen data is staged in a hidden folder called naverwhale, a nod to South Korea's home-grown Naver Whale browser. The intent is to look like something that belongs on a Korean user's machine. Command-and-control traffic uses Korean domains alongside the pCloud API as a dead drop, hiding the malicious traffic inside legitimate cloud activity that most network monitoring will wave through without a second glance.

A rebuild, not a reinvention

The genuinely interesting wrinkle is the tooling itself. ScarCruft has stuck to its own RokRAT family for years. Pivoting to a new Python-based implant is a meaningful change of habit, even if the scheduled-task naming conventions are recognisably similar to earlier campaigns. The fingerprints of the operators are the same, the kit underneath is new. That points to a group quietly rebuilding its arsenal while keeping its operational rhythm intact.

For the people on the receiving end, none of the clever in-memory execution or pCloud dead-dropping really matters. The part staff will actually encounter is the email. A security alert that demands urgent action and points to an attached advisory is the oldest pretext in the book, and it still works because the branding is right and the panic feels real. Microsoft logos, account language, the implied threat that something has already gone wrong. That is the bit doing the heavy lifting. Everything downstream of the click is just engineering.