UNK_DeadDrop Uses Malicious IDE Repositories to Steal Developer Credentials and Crypto Wallets
Summary
Proofpoint details UNK_DeadDrop phishing targeting developers at nearly 100 organizations. Malicious repositories abuse IDE automation and VSIX extensions to steal credentials and crypto wallets across Windows, macOS, and Linux; attribution to North Korea is assessed as
Key points
- Proofpoint observed more than 250 phishing emails between April and May 2026, targeting developers at nearly 100 organizations with recruitment, code-review, and project-testing lures.
- Emails linked to attacker-controlled GitHub or GitLab repositories. Opening a repository in VS Code or Cursor could trigger a folder-open task; Proofpoint notes Cursor did not show a trust dialog in its testing.
- The campaign installed a malicious VSIX extension for persistence on macOS and Linux. Linux and macOS payloads used Go binaries derived from the Overlord framework as persistent RATs.
- On Windows, the chain ran JavaScript inside the editor’s Electron process and used encrypted payloads for wallet collection and credential theft; the article says this variant did not persist across editor restarts.
- The malware targeted browser credentials, keychains, cryptocurrency wallet data, and other credentials, then uploaded collected data to command-and-control infrastructure.
- Proofpoint says the activity resembles Contagious Interview but tracks UNK_DeadDrop separately because its telemetry and infrastructure did not directly overlap.
- Proofpoint assesses the activity as likely North Korea-aligned, while noting that attribution to a known actor remains unconfirmed.
Article Details
- Attack Vectors
- Phishing emails used recruitment, code-review, Foundry testing, and AI-payments lures to direct developers to attacker-controlled GitHub or GitLab repositories.
- Opening a cloned repository in VS Code or Cursor triggered platform-specific scripts through folder-open task automation; the repositories also installed a malicious VSIX extension.
- Linux and macOS payloads used Overlord Go binaries for persistent remote access. The Windows chain ran JavaScript in the editor's Electron process and used Python for credential theft.
- The campaign collected cryptocurrency wallet data, browser credentials, and system keychain data, then uploaded stolen files to command-and-control infrastructure.
- Defensive Notes
- The article reports that VS Code prompts users before running tasks, while Cursor silently executes folder-open tasks without a trust dialog.
- The infection chain installs a malicious VSIX extension and removes payloads and repository artifacts during cleanup; checking only for dropped binaries may miss the Windows chain, which runs JavaScript inside the editor's Electron process.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | contacttrixauvex[.]ink | Attacker-controlled sender domain used for recruiter phishing. |
| DOMAIN | predicttocareer[.]space | Attacker-controlled sender domain used for recruiter phishing. |
| DOMAIN | pulsynk[.]org | Campaign domain used for fake-company infrastructure and phishing. |
| DOMAIN | trixauvex[.]org | Campaign domain used for fake-company infrastructure and phishing. |
alex@contacttrixauvex[.]ink | Attacker-controlled recruiter email address used in the campaign. | |
alex@pulsynk[.]org | Attacker-controlled recruiter email address used in the campaign. | |
| IPV4 | 170[.]205[.]29[.]83 | Sender IP and hosting infrastructure associated with early UNK_DeadDrop campaigns. |
| IPV4 | 170[.]205[.]30[.]227 | Sender IP associated with early UNK_DeadDrop campaigns. |
| IPV4 | 23[.]137[.]105[.]75 | Command-and-control IP used by Overlord and the Windows pipeline for communication and exfiltration. |
| SHA256 | 2812e0847d472cb8870c94f463331dbe53b84135132b9bf5f6d84c2382be628f | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | 339907b44f161f57ff30819f422c552382ff437b3ae437463b4222cfe86bd943 | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | 35813f4401d3ad77b618275473a556eb47bfa6f4b7439dd8943b19f81aa7252e | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | 4c0d9b802c075be79e9edb52d88f8dd72e6904f5c58267213745818470945c78 | SHA-256 listed for a malicious campaign launcher script. |
| SHA256 | 52886aab179f26421678ff23af1b0fabf0a17ffbb534369cdbbac8008cbed8e7 | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | 62761f38ed194c59abe15c49f09f0ebc431ac852c965180c9327ed84d3a454fb | SHA-256 listed for a malicious campaign launcher script. |
| SHA256 | 6cf9f7b2aa456a0b438600588df869b38d8007e28f01fa96022f9d8059f120b0 | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | 734699773e53d995f20d485eb61261033d9d00b4332b39ca26071bcd60cd352f | SHA-256 listed for the malicious run-update.sh launcher. |
| SHA256 | 808e7154b7af2bc7a4b28d577297c55f77221c355191cbe00f9f1810b6d4a619 | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | 91b9381d19b2e6a2db5cc0307167979b502731cb3fb50da684479e9ed35261aa | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | a2b9a769df84d9d3a4694bb0252a2c6a5e5f5d1a85a04565362737092bbb3a86 | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | bb10adac5b0124efedfe71102c1d5638135ec9e1cde8c8cb3353c5ed91bb9f81 | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | c935808147f0236c81483d7bbeda4b9d602f3595d5d4057f8115d39e222d1c4b | SHA-256 listed among UNK_DeadDrop malicious scripts and packages. |
| SHA256 | d3ebce2f05fe91a8260e87fd11a6ea17c156703d081b3f91d9bbe5fd6aeedc10 | SHA-256 listed for the malicious gus-node-bootstrap.js campaign component. |
| SHA256 | d5e9288693aa745dc89368deac677e7ea1ec81e663283af30838cdae189b7a7e | SHA-256 listed for a malicious campaign extension component. |
| SHA256 | e1bf1b29e6fa3525d7f32f429290a88d6ea2890e61c06574b8ff6372aa5d0667 | SHA-256 listed for a malicious campaign agent archive. |
| URL | hxxps[:]//github[.]com/Pulsynk/pulsynk | Attacker-controlled repository used to deliver malicious campaign content. |
| URL | hxxps[:]//github[.]com/Trixauvex-org/trixauvex | Attacker-controlled repository used to deliver malicious campaign content. |
| URL | hxxps[:]//gitlab[.]com/predict-together/forge-4626invariants.git | Attacker-controlled repository used to deliver malicious campaign content. |
| URL | hxxps[:]//gitlab[.]com/pulsynk-org/rekt-db.git | Attacker-controlled repository used to deliver malicious campaign content. |
| URL | hxxps[:]//gitlab[.]com/trixauvex-org/x402-kit.git | Attacker-controlled repository used to deliver malicious campaign content. |
MITRE ATT&CK
T1012 · Query RegistryThe Windows stealer queried the registry to enumerate user profiles beyond the current user.T1027 · Obfuscated Files or InformationThe campaign used Base64-encoded scripts and encrypted payload files that were decrypted at runtime.T1041 · Exfiltration Over C2 ChannelStolen wallet and credential data was uploaded to the command-and-control server over WebSocket or HTTP POST.T1059.003 · Windows Command ShellThe Windows launcher chain used run-update.cmd to decode and stage the next components.T1059.004 · Unix ShellThe Linux and macOS launcher used a Bash script to install the extension and launch the payload.T1059.005 · Visual BasicOn Windows, wscript.exe ran the hidden VBS launcher that started the next stage.T1059.006 · PythonThe Windows credential-stealing pipeline executed Python code, including detect_malware.py.T1059.007 · JavaScriptThe Windows pipeline ran JavaScript inside the editor's Electron process using ELECTRON_RUN_AS_NODE=1.T1071.001 · Web ProtocolsOverlord used persistent WebSocket connectivity for command-and-control, and the Windows pipeline used HTTP POST.T1105 · Ingress Tool TransferThe Windows stealer attempted to download Python 3.12.8 from the command-and-control server.T1204.002 · Malicious FileThe infection chain relied on targets cloning a repository and opening it in an editor to trigger its malicious task.T1552.001 · Credentials In FilesOn Linux, the malware exported collected credentials to e_p.txt before packaging and uploading them.T1555 · Credentials from Password StoresThe malware extracted browser credentials and Safe Storage keys and dumped the macOS login keychain.T1566.002 · Spearphishing LinkPhishing emails linked to attacker-controlled GitHub and GitLab repositories posing as job assessments or code reviews.
People
Threat Actors
Contagious InterviewDescribed as another North Korea-aligned group with developer-targeting and cryptocurrency-theft activity. Proofpoint notes similarities to UNK_DeadDrop but reports no direct telemetry overlap and tracks UNK_DeadDrop separately.UNK_DeadDropProofpoint tracks this cluster as conducting developer-targeted phishing and deploying cross-platform malware to steal cryptocurrency wallets and credentials. Proofpoint assesses it as likely North Korea-aligned; attribution to a known actor remains unconfirmed.
Malware
Products
BraveAfter password validation, the malware modifies Keychain ACLs for the following browsers: Chrome, Brave, Edge, Opera, Vivaldi, Arc, Yandex, and Chromium.ChromiumAfter password validation, the malware modifies Keychain ACLs for the following browsers: Chrome, Brave, Edge, Opera, Vivaldi, Arc, Yandex, and Chromium.CursorThe campaigns abused VS Code and Cursor task automation plus malicious VSIX extensions to steal cryptocurrency wallets and credentials on macOS, Linux, and Windows while maintaining persistence and cleaning up artifacts.EdgeAfter password validation, the malware modifies Keychain ACLs for the following browsers: Chrome, Brave, Edge, Opera, Vivaldi, Arc, Yandex, and Chromium.GitHuband code-review lures to target developers across nearly 100 organizations and delivered malicious GitHub/GitLab repositories with cross-platform payloads.GitLaband code-review lures to target developers across nearly 100 organizations and delivered malicious GitHub/GitLab repositories with cross-platform payloads.Google ChromeThe threat actor added three custom modules: browserlogin (Chrome and Firefox credential theft), companywallet (crypto wallet stealer with 2-phase ZIP+upload exfiltration), and cleanup (anti-forensic removal ofMozilla FirefoxThe threat actor added three custom modules: browserlogin (Chrome and Firefox credential theft), companywallet (crypto wallet stealer with 2-phase ZIP+upload exfiltration), and cleanup (anti-forensic removal ofVSCodeThe campaigns abused Visual Studio Code workflows and deployed a stealthy new technique using malicious Visual Studio Extensions (VSIX) that requires minimal user interaction.VSCodiumWhen executed, it installs the VSIX extension in all available editors (Cursor, VS Code, VSCodium), resolves the correct Go binary for the platform, removes macOS quarantine, and launches Overlord fully detached.
Countries
Industries
business servicesto individuals in almost 100 organizations across several sectors, primarily technology, education, business services, and financial services, specifically organizations in the cryptocurrency industry.CryptocurrencyThe campaigns abused VS Code and Cursor task automation plus malicious VSIX extensions to steal cryptocurrency wallets and credentials on macOS, Linux, and Windows while maintaining persistence and cleaning up artifacts.Educationrecruitment or code review themes to targets in close to 100 organizations in finance, cryptocurrency, education, technology, and several other sectors.Financial Services100 organizations across several sectors, primarily technology, education, business services, and financial services, specifically organizations in the cryptocurrency industry.Technologyor code review themes to targets in close to 100 organizations in finance, cryptocurrency, education, technology, and several other sectors.