North Korean Hackers Exploit GitHub Repos to Infect Devs

Key Takeaways

• A North Korean-aligned threat group, dubbed UNK_DeadDrop, is actively compromising developers through malicious GitHub and GitLab repositories.
• The attackers use fake job offers and code review requests to trick developers into cloning infected projects, leading to malware execution across Windows, macOS, and Linux.
• The sophisticated malware facilitates remote access, steals credentials, drains cryptocurrency wallets, and exfiltrates sensitive browser data.
• Organizations in finance, cryptocurrency, education, and technology, primarily in the United States, are the main targets.

North Korean Hackers Leverage GitHub Repositories to Compromise Developers

A persistent North Korea-backed hacking collective has intensified its attacks on the global developer community, employing a new tactic that involves embedding malicious code within seemingly legitimate GitHub repositories. This campaign, identified as UNK_DeadDrop, uses deceptive job offers and requests for code review to entice developers into cloning compromised repositories, inadvertently executing malware on their systems.

Between April and May 2026, the threat actors dispatched over 250 phishing emails to individuals across nearly 100 organizations. The primary targets included companies in the finance, cryptocurrency, education, and technology sectors, with a significant concentration of affected entities located in the United States. The attackers meticulously crafted their outreach, utilizing convincing fake company names and professional-looking sender domains to lend an air of authenticity to their malicious communications.

According to a report by analysts at Proofpoint, shared with Cyber Security News (CSN), this activity is attributed to a North Korea-aligned threat actor and is being tracked as a distinct cluster. Researchers noted substantial similarities with a previously identified group known as Contagious Interview, although no direct infrastructure overlaps were observed in Proofpoint’s telemetry data.

Multi-Platform Malware and Sophisticated Attack Chain

The malware deployed in this campaign demonstrates cross-platform compatibility, capable of infecting macOS, Linux, and Windows operating systems. It utilizes Overlord, an open-source Go framework, to establish and maintain persistent connections to its command-and-control (C2) server. The infection chain grants the attackers remote access, enables the theft of credentials, facilitates the draining of cryptocurrency wallets, and exfiltrates sensitive browser data.

The campaign’s efficacy stems from its seamless integration into a developer’s routine workflow. A developer receiving what appears to be a genuine technical assignment email would typically clone a repository and open it in their code editor without suspicion. This seemingly innocuous action is precisely where the attack commences.

How GitHub Repositories Are Being Used as Weapons

The attack initiates with a phishing email that directs the target to a GitHub or GitLab repository designed to mimic a legitimate coding project. These emails often masquerade as recruitment messages or code review requests from fabricated or spoofed entities such as Pulsynk, Trixauvex, or Ondo Finance.

Upon cloning the repository and opening it in development environments like Visual Studio Code or Cursor, a hidden tasks.json file located within a concealed .vscode folder automatically executes malicious scripts. On macOS and Linux systems, this script installs a malicious VS Code extension (VSIX) disguised as a Google service, subsequently launching the Overlord backdoor. For Windows users, the payload operates entirely within the editor’s process, leaving no binary on disk, which significantly complicates detection efforts.

The clever use of VS Code’s task automation feature is particularly insidious, as this behavior appears completely normal within a developer’s environment. Notably, the Cursor IDE executes these hidden tasks without any user prompts, rendering the attack entirely stealthy on that platform.

Credential Theft Across All Platforms

Once the malware establishes a foothold, its primary objective shifts to exfiltrating valuable data. On macOS, a secondary embedded binary named darwin-password-prompt displays a fake system dialog, coercing the user into providing their device password. After successfully capturing and validating the password, the malware modifies browser keychain access and proceeds to dump credentials from popular browsers including Chrome, Brave, Edge, and Opera.

Similarly, on Linux, the malware employs a native system dialog tool called Zenity to generate a fraudulent prompt and targets GNOME Keyring credentials using Python scripts. The Windows variant adopts a more technical approach, bypassing App-Bound Encryption in Chromium browsers and extracting credentials via DPAPI. This version specifically targets 35 cryptocurrency wallet extensions, 18 standalone wallet applications, and browser cookies.

All harvested data, encompassing wallet contents, Safe Storage keys, login credentials, and browser cookies, is compressed into a ZIP archive and uploaded to the attacker-controlled server at 23.137.105[.]75:5173. Developers managing high-value cryptocurrency accounts or operating within the Decentralized Finance (DeFi) and blockchain sectors face the most significant risk from this campaign.

What You Should Do

• Exercise Extreme Caution with Emails: Be highly suspicious of unsolicited job offers or code review requests, even if they appear professional. Verify sender identities independently through official channels.
• Inspect Repositories Carefully: Before cloning any repository, especially from external or unverified sources, thoroughly inspect its contents. Look for unexpected .vscode folders or suspicious tasks.json files.
• Restrict Automatic Task Execution: Configure your IDE (e.g., VS Code) to disable or prompt before automatically executing tasks. Review and understand any tasks that are configured to run.
• Monitor Network Traffic: Implement network monitoring to detect unusual outbound connections, particularly to unknown WebSocket endpoints or IP addresses like 23.137.105[.]75 (port 5173).
• Use Strong, Unique Passwords and MFA: Employ strong, unique passwords for all accounts and enable multi-factor authentication (MFA) wherever possible. This adds a critical layer of defense against credential theft.
• Isolate Development Environments: Consider using virtual machines or isolated environments for development work, especially when interacting with unfamiliar codebases.
• Keep Software Updated: Ensure your operating systems, IDEs, and security software are regularly updated to protect against known vulnerabilities.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.