Void Dokkaebi Turns Fake Job Interviews Into a Self-Propagating Supply-Chain Attack
Summary
Trend Micro says North Korean actor Void Dokkaebi uses fake developer job interviews and malicious VS Code tasks to spread malware through repositories, steal credentials, and stage payloads on blockchain networks.
Key points
- Trend Micro attributes the campaign to North Korean actor Void Dokkaebi, also known as Famous Chollima, which uses fake recruiter-led coding tests to target developers.
- Malicious VS Code workspace tasks can run after a developer accepts the workspace trust prompt; some fetch a backdoor, while others launch a payload hidden in a font or image file.
- Commit tampering hides the malicious .vscode folder, allowing infected repositories to expose later cloners, forks, contributors, and downstream projects.
- Trend Micro reported finding more than 750 infected repositories, over 500 malicious VS Code task configurations, and 101 instances of a commit-tampering tool in March.
- Trend Micro says payloads are staged on Tron, Aptos, and Binance Smart Chain.
- Recommended precautions include isolating unfamiliar code, using dependency lock files, monitoring commits, limiting privileges, and enforcing code-signing validation.
Article Details
- Event Type
- Self-propagating software supply-chain attack using fake job-interview lures and malicious Visual Studio Code workspace tasks.
- Impact
- The campaign infects developer repositories and can spread through commits, forks, contributors, and downstream projects. Trend Micro reported identifying more than 750 infected code repositories, over 500 malicious VS Code task configurations, and 101 instances of a commit-tampering tool in March. The activity can expose developer credentials, cryptocurrency wallet credentials, signing keys, CI/CD pipelines, and production infrastructure.
MITRE ATT&CK
People
Threat Actors
Vendors
Products
Bitbucketinterview where the victim is asked to clone a code repository — hosted either on GitHub, GitLab, or Bitbucket and appearing legitimate — and review or run it as part of a technical assessment, according to TrendGitHubwith a fabricated job interview where the victim is asked to clone a code repository — hosted either on GitHub, GitLab, or Bitbucket and appearing legitimate — and review or run it as part of a technical assessment,GitLabfabricated job interview where the victim is asked to clone a code repository — hosted either on GitHub, GitLab, or Bitbucket and appearing legitimate — and review or run it as part of a technical assessment,VSCodeThe campaign abuses Visual Studio Code workspace tasks and commit tampering, uses blockchain networks for payload staging, and can cascade infections across forks and downstream projects.