Google Cloud’s Mandiant unit says a North Korea-linked malware campaign targeting crypto users, tracked since 2018, has sharply increased in scale after adopting AI-driven techniques in November 2025. The detection highlights growing automation risks for the crypto ecosystem.