North Korean WaterPlum Uses VS Code Auto-Run Tasks to Deliver StoatWaffle
Summary
NTT Security reports that WaterPlum uses malicious VS Code projects to auto-run tasks and deliver StoatWaffle, which includes browser-stealing and RAT modules. Microsoft added settings and prompts to reduce unintended task execution.
Key points
- NTT Security reported that WaterPlum has used malicious VS Code projects since December 2025, with tasks.json configured to run when a project folder opens.
- The delivery chain checks for Node.js, installs it if absent, and polls external servers for additional downloader stages.
- StoatWaffle reportedly includes a stealer targeting browser credentials and extension data, plus iCloud Keychain data on macOS, and a RAT that can run commands and transfer files.
- Related activity includes npm packages distributing PylangGhost and obfuscated JavaScript in hundreds of public GitHub repositories that leads to BeaverTail.
- The campaigns use fake interviews, coding assessments, and LinkedIn approaches to target developers and cryptocurrency or Web3 professionals.
- VS Code 1.109 added the task.allowAutomaticTasks setting, defaulting to off; versions 1.109 and 1.110 also warn users when a newly opened workspace contains an auto-run task.
Article Details
- Event Type
- Malware distribution campaign using malicious Visual Studio Code projects and social engineering
- Impact
- The campaign delivers StoatWaffle, which can steal browser credentials and extension data, steal the iCloud Keychain database on macOS, execute commands, and upload files. Related activity uses malicious npm packages and compromised GitHub repositories to distribute additional malware. Developers and cryptocurrency professionals are targeted. Microsoft added safeguards against automatic task execution in Visual Studio Code versions 1.109 and 1.110.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationA campaign implanted an obfuscated JavaScript payload in public GitHub repositories.T1041 · Exfiltration Over C2 ChannelThe stealer uploads captured browser data to a command-and-control server; the RAT can also upload files.T1059.007 · JavaScriptDownloaded payloads and malware modules execute Node.js code, including code received from external servers.T1083 · File and Directory DiscoveryThe RAT can enumerate files and directories and recursively search directories.T1105 · Ingress Tool TransferThe downloader polls external servers to retrieve next-stage payloads.T1204.002 · Malicious FileTargets are persuaded to run malicious commands or packages during staged recruitment and technical interviews.T1555.003 · Credentials from Web BrowsersThe stealer captures credentials and extension data stored in Chromium-based browsers and Mozilla Firefox.
People
Alexander Paul TravisThe article reports that he pleaded guilty and was sentenced for his role in furthering North Korea’s fraudulent IT worker scheme, including use of his identity by North Korean workers.Audricus PhagnasayThe article reports that he pleaded guilty and was sentenced for his role in furthering North Korea’s fraudulent IT worker scheme.Jason SalazarThe article reports that he pleaded guilty and was sentenced for his role in furthering North Korea’s fraudulent IT worker scheme.Margaret HeapThe U.S. attorney for the Southern District of Georgia commented on the sentencing of individuals involved in the fraudulent IT worker scheme.
Threat Actors
Contagious InterviewThe article attributes the Contagious Interview campaign and distribution of StoatWaffle through malicious Visual Studio Code projects to WaterPlum.GhostCallA related campaign targeting cryptocurrency professionals is reported to share activity overlap with the cluster tracked as GhostCall; the article does not establish that GhostCall conducted the specific StoatWaffle activity.UNC1069A related campaign targeting cryptocurrency professionals is reported to share activity overlap with the cluster tracked as UNC1069; the article does not establish that UNC1069 conducted the specific StoatWaffle activity.
Malware
BeaverTailpayload in hundreds of public GitHub repositories that culminates in the deployment of a new version of BeaverTail, a known stealer and downloader malware attributed to Contagious Interview.FlexibleFerret(a backdoor capable of extensive data theft), InvisibleFerret (a Python-based backdoor), and FlexibleFerret (a modular backdoor implemented in both Go and Python).GolangGhostIts Go and Python variants go by the monikers GolangGhost and PylangGhost, respectively.InvisibleFerretas part of these attack chains include OtterCookie (a backdoor capable of extensive data theft), InvisibleFerret (a Python-based backdoor), and FlexibleFerret (a modular backdoor implemented in both Go and Python).OtterCookieSome of the key malware families deployed as part of these attack chains include OtterCookie (a backdoor capable of extensive data theft), InvisibleFerret (a Python-based backdoor), and FlexibleFerret (a modularPylangGhostA set of malicious npm packages that distribute the PylangGhost malware, marking the first time the malware has been propagated via npm packages.StoatWaffleNorth Korean threat actor WaterPlum (aka Contagious Interview) is distributing the Node.js StoatWaffle malware through malicious Visual Studio Code projects that auto-run tasks.json to fetch and execute payloads.WeaselStoreIt’s worth mentioning here that FlexibleFerret is also referred to as WeaselStore.
Vendors
Products
GitHubThe campaign delivers a browser credential stealer and a RAT, abuses npm packages and compromised GitHub repositories, targets developers and crypto professionals via fake interviews and LinkedIn lures, and promptedLinkedInand compromised GitHub repositories, targets developers and crypto professionals via fake interviews and LinkedIn lures, and prompted Microsoft mitigations in VS Code 1.109/1.110.Node.jsNorth Korean threat actor WaterPlum (aka Contagious Interview) is distributing the Node.js StoatWaffle malware through malicious Visual Studio Code projects that auto-run tasks.json to fetch and execute payloads.npmThe campaign delivers a browser credential stealer and a RAT, abuses npm packages and compromised GitHub repositories, targets developers and crypto professionals via fake interviews and LinkedIn lures, and promptedVercel“This task is configured so that it downloads data from a web application on Vercel regardless of executing OS [operating system],” NTT Security said in a report published last week.VSCodeNorth Korean threat actor WaterPlum (aka Contagious Interview) is distributing the Node.js StoatWaffle malware through malicious Visual Studio Code projects that auto-run tasks.json to fetch and execute payloads.