North Korea-Linked Campaign Uses Malicious VS Code Projects to Target Developers
Summary
Proofpoint says UNK_DeadDrop used recruitment and code-review lures to target nearly 100 organizations, abusing VS Code project auto-execution to install malware and steal credentials and wallet data. The article also summarizes separate malicious-extension and supply‑
Key points
- Proofpoint reports that UNK_DeadDrop sent more than 250 emails over six weeks, targeting people at nearly 100 organizations.
- The lures directed developers to malicious GitHub repositories; opening projects in VS Code could trigger code execution through the runOn: folderOpen feature.
- The campaign used loaders and a malicious VS Code extension to steal credentials and wallet data. Linux and macOS infection chains also deployed a customized Overlord framework.
- Proofpoint tracks UNK_DeadDrop separately from Contagious Interview, while describing it as North Korea-linked; the article notes differences in initial access and malware use.
- Yeeth Security reported three malicious VS Code marketplace extensions using SharePoint and Microsoft Graph API for command-and-control and file operations; it said there was no direct overlap with a publicly documented North Korean campaign.
- The article also describes separate npm and GitHub campaigns, including TaskJacker, which uses malicious VS Code task files, and campaigns distributing BeaverTail and OtterCookie.
Article Details
- Event Type
- Reported phishing, malicious developer-tool, and software supply-chain campaigns targeting developers with malware.
- Impact
- The reported activity used recruitment and code-review lures, malicious GitHub repositories, VS Code extensions, and npm packages to compromise developer systems and steal credentials, wallet data, and files. Proofpoint reported more than 250 emails targeting individuals at nearly 100 organizations. Separately, Expel reported that campaigns stole $12 million in cryptocurrency during the first three months of 2026 and exfiltrated 26,584 cryptocurrency wallets from 2,726 infected developer systems.
MITRE ATT&CK
T1036 · MasqueradingMalicious VS Code extensions were disguised as legitimate services or harmless productivity tools.T1041 · Exfiltration Over C2 ChannelStolen data was exfiltrated to a server over an HTTP POST request.T1056.002 · GUI Input CaptureThe malware displayed a fake security prompt asking users to enter their system password.T1059.001 · PowerShellPowerShell implants were used for credential and data theft in campaigns described in the article.T1059.003 · Windows Command ShellThe Windows infection chain used a CMD file to install a malicious VS Code extension.T1059.004 · Unix ShellShell scripts were used as loaders on macOS and Linux.T1059.005 · Visual BasicA VBScript payload was used in the Windows attack chain.T1059.006 · PythonA Python script was used by malicious extensions for code execution on Linux and macOS.T1059.007 · JavaScriptMalicious JavaScript handled C2 communications and was used in loaders and payloads.T1082 · System Information DiscoveryThe malicious extension supported system reconnaissance.T1105 · Ingress Tool TransferA JavaScript malware loader fetched a next-stage payload from blockchain and public RPC infrastructure.T1195.002 · Compromise Software Supply ChainMalicious npm packages and compromised developer packages were used to deliver payloads.T1555.003 · Credentials from Web BrowsersCampaigns targeted credentials and data from browser wallet extensions.T1566.002 · Spearphishing LinkRecruitment-themed phishing emails contained links to malicious GitHub repositories.T1567.002 · Exfiltration to Cloud StorageA SharePoint site was used as an exfiltration channel by malicious VS Code extensions.
People
Carlos RubioProofpoint researcher quoted describing the UNK_DeadDrop infection chain and its malicious repositories.Marcus HutchinsExpel representative cited for data on cryptocurrency theft and wallets exfiltrated from infected developer systems.Saher NaumaanProofpoint researcher quoted describing the UNK_DeadDrop infection chain and its malicious repositories.
Threat Actors
BlueNoroffThe article attributes macOS-targeting social-engineering campaigns and delivery of data-stealing malware to this threat actor.Contagious InterviewThe article describes this North Korean-linked threat cluster as conducting developer-targeting campaigns involving fake interviews, malicious repositories, and malware.HexagonalRodentNamed in the article as an alias of Contagious Interview, the North Korea-linked threat cluster associated with malicious developer-targeting campaigns.Sapphire SleetNamed in the article as an alias of BlueNoroff, which it describes as targeting macOS users in financial and cryptocurrency-related sectors.UNC1069Named in the article as an alias of BlueNoroff, which it describes as targeting macOS users in financial and cryptocurrency-related sectors.Void DokkaebiNamed in the article as an alias of Contagious Interview, the North Korea-linked threat cluster associated with malicious developer-targeting campaigns.
Malware
BeaverTail#ContagiousInterviewCabbage RATThe attacks led to the deployment of updated variants of Cabbage RAT (aka CageyChameleon), PowerShell implants capable of credential and data theft, or a newly identified data-stealing macOS toolkit known as Mach-O Man.CageyChameleonThe attacks led to the deployment of updated variants of Cabbage RAT (aka CageyChameleon), PowerShell implants capable of credential and data theft, or a newly identified data-stealing macOS toolkit known as Mach-O Man.ClipViper#ContagiousInterviewDEV#POPPERThe final payload is a variant of the DEV#POPPER RAT.InvisibleFerret#ContagiousInterviewMach-O ManThe attacks led to the deployment of updated variants of Cabbage RAT (aka CageyChameleon), PowerShell implants capable of credential and data theft, or a newly identified data-stealing macOS toolkit known as Mach-O Man.OtterCookie#ContagiousInterviewPromptMink#ContagiousInterview
Vendors
Products
Cursorcryptocurrency-related projects, instructing recipients to clone the repository and open it in VS Code or Cursor, resulting in the execution of operating system-specific malware loaders for Linux, macOS, and Windows.GitHubuncovered UNK_DeadDrop, a North Korea-linked phishing campaign using recruitment and code-review lures on GitHub to push malicious VS Code projects and Overlord malware against developers across nearly 100Microsoft SharePointYeeth Security found trojanized VS Code extensions that used SharePoint and Microsoft Graph API for C2.npmSeparately, malicious VS Code extensions and multiple npm/GitHub supply-chain campaigns were found delivering backdoors and stealers that target credentials, wallets, and developer systems.VSCodeA crucial aspect connecting the campaign to Pyongyang is the use of Microsoft Visual Studio Code (VS Code) projects that employ the “runOn: folderOpen” technique to trigger the execution of malicious code every time the
Tools
Countries
AustraliaOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.BrazilOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.FranceOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.GermanyOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.IndiaOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.IsraelOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.JapanOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.NetherlandsOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.North KoreaResearchers uncovered UNK_DeadDrop, a North Korea-linked phishing campaign using recruitment and code-review lures on GitHub to push malicious VS Code projects and Overlord malware against developers across nearly 100United StatesOver 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.
Industries
Cryptocurrencyusing developer role recruitment or code review themes to target nearly 100 organizations in finance, cryptocurrency, education, technology, and several other sectors.Educationrole recruitment or code review themes to target nearly 100 organizations in finance, cryptocurrency, education, technology, and several other sectors.financecampaigns using developer role recruitment or code review themes to target nearly 100 organizations in finance, cryptocurrency, education, technology, and several other sectors.Investmentinfostealer malware as part of a targeted social engineering against individuals in the cryptocurrency, investment, and Web3 space.Technologyor code review themes to target nearly 100 organizations in finance, cryptocurrency, education, technology, and several other sectors.Web3as part of a targeted social engineering against individuals in the cryptocurrency, investment, and Web3 space.