Void Dokkaebi Uses Fake Job Interviews to Spread Malware Through Developer Repositories
Summary
Trend Micro reports that Void Dokkaebi uses fake coding interviews, malicious VS Code tasks, and injected code to spread malware through developer repositories. Its March 2026 scan found more than 750 infected public repositories.
Key points
- Fake job interviews persuade developers to clone and run malicious repositories, initiating infection.
- Malicious VS Code tasks can execute when a developer opens and trusts a workspace, then spread through committed repositories.
- Attackers also inject obfuscated JavaScript into project files and rewrite Git history to conceal tampering.
- A loader retrieves payloads through Tron, Binance Smart Chain, and, as a fallback, Aptos; one payload is a DEV#POPPER RAT variant.
- The RAT targets developer workstations and avoids CI/CD environments and cloud sandboxes, making pipeline-only scanning insufficient.
- Trend Micro found more than 750 repositories with the loader, 523 malicious VS Code task files, and the commit-tampering tool in at least 101 repositories.
- Recommendations include using disposable environments for coding tests, ignoring .vscode folders, enforcing branch protection and signed commits, and auditing repositories and developer endpoints.
Article Details
- Attack Vectors
- Fake job-interview lures persuade developers to clone and run repositories hosted on GitHub, GitLab, or Bitbucket.
- Malicious VS Code workspace tasks configured with runOn: folderOpen execute when a victim opens and trusts an infected workspace; some tasks fetch a payload remotely, while others launch a bundled font or image file containing the payload.
- After gaining remote access to a developer workstation, the attackers inject obfuscated JavaScript into repository files and use temp_auto_push.bat to amend and force-push commits while concealing the tampering.
- The injected loader retrieves encrypted payloads using references obtained from blockchain transactions, with a fallback from Tron to Aptos and payload data retrieved from Binance Smart Chain.
- A DEV#POPPER RAT variant uses WebSocket C2 and HTTP for file uploads, directory exfiltration, and logging; it also persists by injecting versioned code into developer applications and creating a hidden .node_modules folder.
- Defensive Notes
- Use disposable, isolated environments for interview coding assignments; do not run interview code on production or personal machines.
- Add .vscode/ to organizational .gitignore files and inspect workspace tasks for runOn: folderOpen before granting trust.
- Block force pushes, require pull requests, and enforce signed commits and branch protection.
- Search repositories for global['!'], global['_V'], and temp_auto_push.bat; if found, isolate the associated workstation, revoke credentials, and notify collaborators and downstream consumers.
- Review configuration-file changes for code appended beyond the visible area, including postcss.config.mjs, tailwind.config.js, eslint.config.mjs, and next.config.mjs.
- Monitor developer workstations for unexpected blockchain API and C2 traffic, MongoDB port 27017, and HTTP paths /u/f and /verify-human/[VERSION].
- Do not rely solely on CI/CD scanning because the RAT reportedly detects and avoids CI/CD environments and cloud sandboxes; use endpoint-level detection on developer workstations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 136[.]0[.]9[.]8 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
| IPV4 | 154[.]91[.]0[.]196 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
| IPV4 | 166[.]88[.]4[.]2 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
| IPV4 | 198[.]105[.]127[.]210 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
| IPV4 | 23[.]27[.]120[.]142 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
| IPV4 | 23[.]27[.]20[.]143 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
| IPV4 | 23[.]27[.]202[.]27 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
| IPV4 | 83[.]168[.]68[.]219 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
| IPV4 | 85[.]239[.]62[.]36 | Listed in a hunting query as a potential Void Dokkaebi C2 address. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader uses string shuffling, hexadecimal obfuscation, character swaps, and whitespace to obscure its code.T1041 · Exfiltration Over C2 ChannelThe RAT uses HTTP, including the /u/f endpoint, for data exfiltration.T1059.003 · Windows Command ShellThe attackers use the Windows batch script temp_auto_push.bat to alter commit history and force-push modified commits.T1059.007 · JavaScriptObfuscated JavaScript injected into repository files executes through Node.js tooling and acts as a multistage loader.T1071.001 · Web ProtocolsThe RAT communicates with its C2 server over WebSocket and uses HTTP for notifications, uploads, exfiltration, and logging.T1204.002 · Malicious FileVictims are lured into cloning and running repository code for a fabricated job interview, then opening and trusting the infected VS Code workspace.
People
Threat Actors
Malware
BeaverTailhave been linked to North Korea, such as InvisibleFerret, OtterCookie, OmniStealer, DEV#POPPER, and BeaverTail, all of which have been observed in Void Dokkaebi’s operations.DEV#POPPER RATThe malware in brief: DEV#POPPER RAT variantInvisibleFerretthe blockchain reference, including other malware that have been linked to North Korea, such as InvisibleFerret, OtterCookie, OmniStealer, DEV#POPPER, and BeaverTail, all of which have been observed in VoidOmniStealerincluding other malware that have been linked to North Korea, such as InvisibleFerret, OtterCookie, OmniStealer, DEV#POPPER, and BeaverTail, all of which have been observed in Void Dokkaebi’s operations.OtterCookiereference, including other malware that have been linked to North Korea, such as InvisibleFerret, OtterCookie, OmniStealer, DEV#POPPER, and BeaverTail, all of which have been observed in Void Dokkaebi’s operations.
Products
Antigravityit injects versioned code (markers: C250617A through C250620A) into developer applications (e.g., Antigravity, VS Code, Cursor, Discord, GitHub Desktop) and creates a hidden .node_modules folder for Node.js moduleBitbucketThe repositories are hosted on GitHub, GitLab, or Bitbucket, and appear to be legitimate coding projects.Cursorcode (markers: C250617A through C250620A) into developer applications (e.g., Antigravity, VS Code, Cursor, Discord, GitHub Desktop) and creates a hidden .node_modules folder for Node.js module search orderDiscord(markers: C250617A through C250620A) into developer applications (e.g., Antigravity, VS Code, Cursor, Discord, GitHub Desktop) and creates a hidden .node_modules folder for Node.js module search order hijacking.GitHubThe repositories are hosted on GitHub, GitLab, or Bitbucket, and appear to be legitimate coding projects.GitHub DesktopC250617A through C250620A) into developer applications (e.g., Antigravity, VS Code, Cursor, Discord, GitHub Desktop) and creates a hidden .node_modules folder for Node.js module search order hijacking.GitLabThe repositories are hosted on GitHub, GitLab, or Bitbucket, and appear to be legitimate coding projects.Node.jsBecause these configuration files are evaluated as JavaScript by Node.js tooling (e.g., build tools, linters, bundlers), any code appended to them executes automatically whenever the corresponding tool runs.Visual Studio CodeThe first spreads passively through Visual Studio Code (VS Code) workspace configurations that travel with committed code.