What Actually Happened

North Korean hackers have been identified as leveraging developer tools to deliver malware through phishing campaigns aimed at organizations across various sectors, including finance and technology. Researchers from Proofpoint report that the threat actor, associated with a group known as Contagious Interview, executed these malicious operations under the codename UNK_DeadDrop. The attack involves phishing emails containing links to GitHub repositories that host malware scripts targeting macOS, Linux, and Windows systems.

The Implementation Reality

This campaign illustrates a significant shift in the tactics employed by threat actors, moving from social engineering via social media to more organized phishing attacks framed as recruitment efforts. The malicious emails direct targets to clone GitHub repositories, which activate malware upon opening in Microsoft Visual Studio Code (VS Code) through a specific technique called “runOn: folderOpen.” This means that any organization using VS Code could inadvertently execute malware without user interaction, increasing the risk of compromise.

Teams should be particularly vigilant since over 75% of the targeted entities are located in the U.S., highlighting a broad potential blast radius. The malware includes a custom version of the Overlord framework, which is designed for data theft and exfiltration via HTTP POST requests to external servers. Additionally, the discovery of malicious VS Code extensions masquerading as legitimate tools further complicates defenses, as they can bypass typical endpoint protections.

What to Do About It

• Review and audit your organization’s use of VS Code and other development tools for suspicious extensions or repositories.
• Implement strict email filtering to block phishing attempts, especially those containing links to GitHub or other code repositories.
• Educate developers on the risks associated with cloning repositories and the importance of verifying sources before executing code.
• Utilize endpoint detection and response (EDR) solutions to monitor for unusual activity indicative of malware execution or data exfiltration.
• Regularly update and patch development environments and tools to mitigate known vulnerabilities and attack vectors.

Source: The Hacker News

At q52, we specialize in AI-augmented security operations and SIEM implementation. Let us help you operationalize threat detection with LLM enrichment — faster triage, fewer false positives, and security intelligence your team can actually act on. Learn about Noogenesis, our AI-powered SIEM platform and connect with us on LinkedIn.