North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels
Summary: Proofpoint flagged two campaigns it ties to the North Korean cluster Contagious Interview, codenamed UNK_DeadDrop, which sent more than 250 recruitment- and code-review-themed emails over six weeks to individuals at nearly 100 organizations, over 75% of them in the U.S. The emails link to actor-controlled GitHub repositories that run malware for macOS, Linux, and Windows when opened in VS Code or Cursor, using a "runOn: folderOpen" technique the actors have employed since December 2025 to trigger execution without user interaction.
Key Takeaway: The payload installs a malicious VS Code extension disguised as a Google service and exfiltrates browser wallet extensions, credentials, and desktop wallet data to a hardcoded server, so a developer opening a cloned repository can compromise a machine with no click required. Separately, Yeeth Security found three backdoored Jupyter Notebook extensions on the official VS Code marketplace, meaning the tooling your developers trust by default is now a delivery channel.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026