Deep Tide TechFlow message: On July 22, according to Protos, AI shopping agent developer ORO said that one of its employees was lured by an attacker disguised as a meeting contact into installing a Microsoft Teams extension containing malicious code, ultimately resulting in the theft of approximately $630k worth of crypto assets. ORO said the attackers were most likely from the North Korea-backed hacker group Sapphire Sleet.

The company also admitted that, because the relevant wallets did not use a hardware wallet solution, the private keys were stolen from the infected device. Currently, ORO is working with exchanges, law enforcement, and relevant ecosystem partners to track and recover the stolen assets.