Lazarus Group used a fake playable NFT game to steal wallet credentials through a vulnerability on Google Chrome.