Kaspersky disclosed that North Korea’s state-sponsored Lazarus Group weaponized a zero-day exploit chain targeting Google Chrome to infiltrate cryptocurrency firms and investors. The campaign lured victims to detankzone[.]com, a fraudulent Web3 multiplayer tank game cloned from legitimate project source code. Visiting the site automatically triggered a hidden script exploiting CVE-2024-4947, a high-severity type confusion vulnerability in Chrome’s V8 JavaScript and WebAssembly engine caused by improper validation when storing to module exports in the JIT compiler.

The exploit granted attackers arbitrary read and write primitives within V8 heap memory, which Lazarus chained with a sandbox escape to execute shellcode directly on the host system without user interaction. Upon gaining execution, the operators deployed reconnaissance modules and the signature Manuscrypt backdoor to harvest system credentials, browser sessions, and cryptocurrency wallet keys. Google patched CVE-2024-4947 in Chrome 125.0.6422.60 following Kaspersky’s private report, confirming active zero-day exploitation in the wild.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: JIT compilation flaws in V8 allow remote attackers to achieve arbitrary memory corruption from ordinary web browsing, bypassing memory safety guarantees and enabling full sandbox escapes when paired with logic vulnerabilities in Chrome’s IPC boundary.
• Bullet 2 — Strategic & Defender Imperative: Targeted drive-by zero-days embedded in social engineering decoys bypass email security and network inspection. Security teams must enforce strict browser isolation, mandate rapid automated browser patch cadence, and restrict Web3 credential storage to hardware tokens.