A North Korea-linked threat actor known as Void Dokkaebi also tracked as Famous Chollima is running an active campaign that turns fake job interviews into a self-spreading malware operation.
The group poses as recruiters from cryptocurrency and AI companies, luring software developers into cloning and executing code repositories as part of fabricated technical assessments.
Once a developer takes the bait, the attack doesn’t stop there. Their own repositories become the source of infection for the next wave of targets.
Trend Micro researchers who analyzed the campaign say the propagation model resembles a worm rather than a conventional targeted attack.
Each compromised developer unknowingly seeds new repositories with the malware, and every developer who later clones those repositories risks the same outcome.
The threat actor primarily targets developers with access to cryptocurrency wallet credentials, signing keys, and CI/CD pipeline infrastructure — making them high-value entry points into broader organizational networks.
How the Infection Spreads Through Developer Workflows
The initial infection begins when a job applicant clones a repository hosted on GitHub, GitLab, or Bitbucket and opens it in Visual Studio Code.
The repository contains a hidden .vscode/tasks.json file that runs automatically when the workspace opens.
If the developer accepts the VS Code workspace trust prompt a routine action most developers perform without scrutiny malicious code runs immediately with no further interaction.
What makes this particularly dangerous is that the .vscode folder is hidden by default in most file explorers and is frequently excluded from .gitignore files.
When the compromised developer later commits their work to GitHub, the malicious configuration file is included.
Any developer who clones that repository next faces the same trust prompt and the same risk. This passive propagation requires no further action on the part of the attackers.
In parallel, Void Dokkaebi uses a second, more aggressive method. On compromised machines, the threat actor remotely injects heavily obfuscated JavaScript into configuration files, such as postcss. config.mjs, tailwind.config.js, and next.config.mjs.
The injected code is pushed to the right edge of the screen using whitespace to make it invisible during casual code review.
According to Trend Micro research, researchers scanning public repositories in late March 2026 found over 750 unique repositories carrying the obfuscated JavaScript loader, 392 malicious tasks.json downloader files, and the commit-tampering tool in at least 101 repositories.
Real-world organizational victims included DataStax and Neutralinojs, where the attack went undetected for three days before being discovered and remediated.
The payload delivered through this infrastructure includes a variant of the DEV#POPPER RAT a cross-platform Node.js remote access trojan that supports simultaneous multi-operator sessions, communicates over WebSocket, and specifically detects and avoids CI/CD environments. This means automated pipeline scans will miss it entirely.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
