BlueNoroff, a subcluster of the threat actor Lazarus Group, sent malicious shortcut files to cryptocurrency exchanges as part of an expansion of its DangerousPassword campaign. The malware was distributed both over email and through LinkedIn messages.