North Korean cybercriminals created a fake version of a real online game to steal cryptocurrency and user data, exploiting previously unknown vulnerabilities in the Google Chrome web browser, according to a Russian cybersecurity firm.

The DPRK’s Lazarus Group, known for its prolific cryptocurrency theft, built an elaborate scheme around a counterfeit version of a legitimate game based around non-fungible tokens (NFT) to deploy its signature Manuscrypt backdoor, Kaspersky said in a report published on Wednesday. 

The firm discovered the attack after detecting Manuscrypt on a customer’s computer in Russia in May. Kaspersky flagged