Since early 2022, North Korean hackers have relentlessly targeted the cryptocurrency industry. Now, they are refining their tactics to go directly after the people building these platforms.
A newly identified threat cluster, tracked by Proofpoint as UNK_DeadDrop, reveals a massive wave of attacks aimed squarely at software developers.
Across April and May 2026, these attackers sent over 250 highly targeted emails to technology and finance professionals, using fake job offers and code review requests as bait to breach secure networks.
North Korean Hackers Weaponize GitHub
The trap springs the moment a developer opens the cloned repository. The attackers hide a configuration file called tasks.json inside a hidden folder.
This file abuses a feature that automatically runs pre-configured tasks when a workspace is opened in the editor.
While VS Code usually prompts the user for permission, the Cursor editor executes this script silently without any interaction, instantly compromising the machine.
Once triggered, the script silently installs a malicious VS Code extension disguised as a legitimate Google service. This extension serves as a persistence mechanism on macOS and Linux, ensuring the malware restarts whenever the editor opens.
The malware quickly connects to an attacker-controlled server to begin stealing data. The primary targets are browser-based cryptocurrency wallets, desktop wallets, decrypted passwords, and valuable API tokens.
To cover their tracks and frustrate security analysts, the scripts finally delete the malicious payloads from the developer’s machine.
UNK_DeadDrop uses highly specialized malware depending on the victim’s operating system. For macOS and Linux users, the infection chain deploys a modified version of the open-source Overlord framework written in Go.
This binary functions as a persistent remote access Trojan. On both operating systems, the malware generates a fake system dialogue box, tricking the user into typing their password to unlock and steal credentials directly from the system keychain or GNOME Keyring.
According to Proofpoint research, instead of dropping a traditional executable file onto the hard drive, it runs entirely as JavaScript within the code editor’s process.
By abusing a built-in feature of the underlying framework, the malware turns the editor into a Node.js interpreter.
It systematically scans for crypto wallets and bypasses modern Windows security features, such as App-Bound Encryption, to extract saved passwords.
It even installs a hidden copy of Python in the browser’s application folder to ensure it can read locked databases. This campaign shows a clear evolution in North Korean cyber operations.
While it shares similarities with previously documented campaigns like “Contagious Interview,” UNK_DeadDrop demonstrates a much higher level of sophistication and industrialization.
By embedding their payloads directly within legitimate-looking repositories and automating execution via trusted developer tools, they have created a highly effective, stealthy trap.
Developers should remain incredibly cautious when asked to open unfamiliar repositories, especially during unsolicited job interviews.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
