cyber.hendryadrian.com
Threat Research · opensourcemalware.com

TasksJacker Supply-Chain Campaign Uses Malicious VS Code Tasks and Blockchain C2

· Original article ↗

Summary

Researchers describe an active campaign attributed with medium-high confidence to DPRK-linked actors, compromising 400+ GitHub repositories through malicious VS Code tasks. Payloads steal credentials and maintain access, using blockchain C2 and newly deployed endpoints.

Key points

  • The report says attackers compromised 400+ GitHub repositories, including repositories associated with DataStax, and that at least nine newly compromised repositories remained infected as of February 20, 2026.
  • Malicious .vscode/tasks.json files use the folder-open trigger to run commands when a developer opens a cloned repository in VS Code.
  • Attackers reportedly rewrote Git history, spoofed commit metadata and force-pushed changes; a compromised DataStax service account pushed to 12 repositories across three organizations in 101 seconds.
  • The multi-stage payload steals browser and cryptocurrency credentials, SSH keys, cloud credentials, environment variables and Git tokens, and installs a persistent backdoor with remote-command capability.
  • The malware retrieves payload references through TRON and Aptos and encrypted payloads from Binance Smart Chain transactions; the report says the original C2 was taken down and new infrastructure was deployed behind shorteners and Vercel endpoints.
  • The researchers assess C2 ownership by the Polin9912 account with high confidence and DPRK affiliation with medium-high confidence; they describe the campaign as ongoing and adapting.
  • The article provides defensive steps, including disabling VS Code automatic tasks, auditing repository task files and Git history, monitoring force pushes and service-account activity, and rotating credentials.

Article Details

Attack Vectors
  • Compromised GitHub repositories contain malicious .vscode/tasks.json files configured to run commands when a developer opens the folder in VS Code.
  • Attackers rewrite Git history, spoofing commit metadata and force-pushing commits that add malicious files while obscuring their presence from pull request file listings.
  • A shell dropper downloaded from campaign infrastructure checks for Node.js, downloads a portable installation if needed, runs an obfuscated JavaScript loader, and deletes itself.
  • The loader retrieves encrypted payload references through TRON and Aptos blockchain data, fetches encrypted payloads from Binance Smart Chain transactions, and XOR-decrypts them.
  • The payload steals browser credentials, cryptocurrency wallet data, SSH keys, AWS credentials, environment variables, API keys, and Git credentials and tokens.
  • A detached backdoor maintains C2 communication and enables remote command execution.
  • The article reports that credentials stolen by TasksJacker were later used in a related fork-and-PR campaign to inject payloads into project configuration files.
Defensive Notes
  • Set VS Code's “Task: Allow Automatic Tasks In Folder” to off or prompt, and inspect .vscode/tasks.json before opening cloned repositories.
  • Compare GitHub API pushed_at timestamps with commit timestamps and investigate discrepancies greater than 24 hours.
  • Audit repositories for unexpected force pushes, commits from service accounts outside normal patterns, and files present in commits but absent from associated pull requests.
  • Review service-account push access, token age and scope; rotate credentials, with the article recommending rotation for credentials older than 90 days.
  • Monitor for Node.js running from hidden .vscode directories and for suspicious inline eval execution.
  • The article recommends monitoring the listed blockchain addresses and campaign infrastructure, while noting that blocking public blockchain API endpoints alone is not definitive.

Indicators of compromise

TypeIndicatorContext
DOMAIN260120[.]vercel[.]appOriginal TasksJacker C2 domain; the article reports it was taken down before February 12, 2026.
DOMAINalanservice[.]vercel[.]appTasksJacker Vercel endpoint identified by the article as active on February 20, 2026.
DOMAINchvsvr[.]short[.]gyTasksJacker shortener subdomain identified as a payload-distribution redirect.
DOMAINdefault-configuration[.]vercel[.]appTasksJacker Vercel endpoint identified by the article as active on February 20, 2026.
DOMAINfelixpools[.]vercel[.]appTasksJacker Vercel endpoint identified by the article as active on February 20, 2026.
DOMAINgeorgeservice77[.]vercel[.]appTasksJacker Vercel endpoint identified by the article as active on February 20, 2026.
DOMAINgurucooldown[.]short[.]gyTasksJacker shortener subdomain identified as a payload-distribution redirect.
DOMAINjameslack[.]vercel[.]appTasksJacker Vercel endpoint identified by the article as active on February 20, 2026.
DOMAINlocation-request-api[.]short[.]gyTasksJacker shortener subdomain identified as a payload-distribution redirect.
DOMAINpesncv[.]short[.]gyTasksJacker shortener subdomain identified as a payload-distribution redirect.
DOMAINvscode-settings-tasks-json[.]vercel[.]appTasksJacker Vercel endpoint identified by the article as active on February 20, 2026.
DOMAINvscodesetting-task[.]vercel[.]appTasksJacker Vercel endpoint identified by the article as active on February 20, 2026.
EMAILjacky870120@outlook[.]comContact email found in a repository associated by the article with the tracked Polin9912 account.
EMAILpolinrider@outlook[.]comEmail appearing in Git commit metadata across repositories associated by the article with the TasksJacker operator persona.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe article describes heavily obfuscated JavaScript and encrypted payloads decrypted with static XOR keys.T1036 · MasqueradingThe attacker places portable Node.js in a hidden .vscode path and disguises it as VS Code files.T1059.004 · Unix ShellThe folder-open task runs a shell command that downloads and pipes the dropper to bash.T1059.007 · JavaScriptThe JavaScript loader executes retrieved code, including through eval().T1070.004 · File DeletionThe Bash dropper deletes itself using a trap on exit.T1071.001 · Web ProtocolsThe malware communicates with blockchain APIs and RPC endpoints over web protocols.T1102.001 · Dead Drop ResolverThe loader retrieves payload references from blockchain transaction data used as a C2 mechanism.T1105 · Ingress Tool TransferThe task downloads a Bash dropper from campaign infrastructure, and the dropper can download portable Node.js.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers injected malicious VS Code task files into compromised GitHub repositories distributed to developers.T1552.004 · Private KeysThe information stealer collects SSH keys from ~/.ssh/.T1555 · Credentials from Password StoresThe information stealer collects credentials from Chrome, Firefox, and Edge.

Threat Actors

GlasswormThe article describes GlassWorm as a separate threat actor behind the ForceMemo campaign and says it is not attributed to DPRK.Lazarus GroupThe article identifies TasksJacker as a Lazarus Group attack, while separately assessing DPRK affiliation as medium-high confidence.PolinRiderThe article identifies PolinRider with the credential-harvesting operation and its later fork-and-PR activity; the name also appears in Git commit metadata.

Malware

TasksJackerOpenSourceMalware identified a new Lazarus Group (DPRK) attack we have dubbed "TasksJacker." It drops malicious VS Code tasks files into unsuspecting GitHub users existing repositories. This is a parallel attack to the

Vendors

DataStaxthreat actors have compromised 400+ GitHub repositories across dozens of organizations—including DataStax, a major database vendor whose repositories are cloned by thousands of developers worldwide.

Products

Aptosuse of multi-blockchain command and control infrastructure by a nation-state actor—spanning TRON, Aptos, and Binance Smart Chain—and you have malware infrastructure that cannot be taken down through traditionalBinance Smart Chaincommand and control infrastructure by a nation-state actor—spanning TRON, Aptos, and Binance Smart Chain—and you have malware infrastructure that cannot be taken down through traditional domain seizures.GitHub(DPRK) attack we have dubbed "TasksJacker." It drops malicious VS Code tasks files into unsuspecting GitHub users existing repositories. This is a parallel attack to the PolinRider upstream injection campaign thatNode.jsChecks if Node.js is installedTRONdocumented use of multi-blockchain command and control infrastructure by a nation-state actor—spanning TRON, Aptos, and Binance Smart Chain—and you have malware infrastructure that cannot be taken down throughVS Codeidentified a new Lazarus Group (DPRK) attack we have dubbed "TasksJacker." It drops malicious VS Code tasks files into unsuspecting GitHub users existing repositories. This is a parallel attack to the

Tools

temp_auto_push.batIn each compromised repository, we found a script called temp_auto_push.bat—an attacker tool accidentally left behind. This script reveals the technique:

Countries

DPRKOpenSourceMalware identified a new Lazarus Group (DPRK) attack we have dubbed "TasksJacker." It drops malicious VS Code tasks files into unsuspecting GitHub users existing repositories. This is a parallel attack to the

Related Articles