{"id":1198,"date":"2026-06-15T20:42:19","date_gmt":"2026-06-15T20:42:19","guid":{"rendered":"https:\/\/cybercolombia.co\/index.php\/2026\/06\/15\/north-korean-hackers-are-turning-developer-tools-into-malware-delivery-channels-cyberdefensa-mx\/"},"modified":"2026-06-15T20:42:19","modified_gmt":"2026-06-15T20:42:19","slug":"north-korean-hackers-are-turning-developer-tools-into-malware-delivery-channels-cyberdefensa-mx","status":"publish","type":"post","link":"https:\/\/cybercolombia.co\/index.php\/2026\/06\/15\/north-korean-hackers-are-turning-developer-tools-into-malware-delivery-channels-cyberdefensa-mx\/","title":{"rendered":"North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels \u2013 CYBERDEFENSA.MX"},"content":{"rendered":"
\n

Cybersecurity researchers have flagged two malicious cyber campaigns that exhibit similarities with a persistent North Korean threat cluster known as Contagious Interview (aka Famous Chollima, HexagonalRodent, and Void Dokkaebi).<\/p>\n

According to a report published by Proofpoint, the threat actor has been found orchestrating phishing campaigns using developer role recruitment or code review themes to target nearly 100 organizations in finance, cryptocurrency, education, technology, and several other sectors. The activity has been codenamed UNK_DeadDrop<\/b>.<\/p>\n

\u00abThe infection chain begins with emails containing links to actor-controlled GitHub repositories hosting malicious scripts that result in the execution of cross-platform malware for macOS, Linux, and Windows, including an open-source Go framework named Overlord<\/a>,\u00bb Proofpoint researchers Saher Naumaan and Carlos Rubio said<\/a>.<\/p>\n

A crucial aspect connecting the campaign to Pyongyang<\/a> is the use of Microsoft Visual Studio Code (VS Code) projects that employ the \u00abrunOn: folderOpen\u00bb technique to trigger the execution of malicious code<\/a> every time the code editor is opened without requiring any user interaction. This approach has been adopted by the Contagious Interview actors since December 2025.<\/p>\n

The activity documented by the enterprise security company involved more than 250 emails that were sent during a six-week period to individuals in almost 100 organizations. Over 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The emails contain links to GitHub repositories masquerading as technical assignments or cryptocurrency-related projects, instructing recipients to clone the repository and open it in VS Code or Cursor, resulting in the execution of operating system-specific malware loaders for Linux, macOS, and Windows. Subsequent lures observed in May 2026 have pivoted their approach by requesting targets to review their open-source projects.<\/p>\n

The loader \u2013 a shell script for macOS and Linux and a VBScript for Windows systems \u2013 is designed to install a malicious VS Code extension (VSIX) that masquerades as a legitimate Google service, while communicating with an external server to facilitate remote command execution, system reconnaissance, and data exfiltration from browser wallet extensions, credentials, and desktop wallet apps.<\/p>\n

The Linux and macOS infection chains lead to a custom version of the open-source Overlord framework with capabilities to enable data theft. It also prompts users to enter their system password using a fake security pop-up. The Windows attack chain, on the other hand, relies on the VBScript payload to run a CMD file, which then installs the extension.<\/p>\n

The end goal remains the same: to steal credentials and data from wallet browser extensions and applications, and exfiltrate the results to the server (\u00ab23.137.105[.]75:5173\u00bb) via an HTTP POST request.<\/p>\n

\u00abUnlike the Linux\/macOS agent, the Windows pipeline does not maintain a persistent connection; it uploads the ZIP files, performs cleanup, and terminates,\u00bb Proofpoint said.<\/p>\n

Further analysis has uncovered that the threat actor previously distributed a Windows Go binary of Overlord, but has since shifted to the new method, likely in an attempt to avoid detection.<\/p>\n

Proofpoint said it\u2019s tracking UNK_DeadDrop as distinct from Contagious Interview due to differences in initial access methods (LinkedIn vs. email) and the use of the Overlord framework, which is different from the custom malware families the North Korean hacking group has traditionally deployed, including BeaverTail, InvisibleFerret, and OtterCookie.<\/p>\n

\u00abUNK_DeadDrop activity suggests North Korea-aligned operations targeting developers for financial gain are maturing and evolving,\u00bb the company said. \u00abThe shift from active social engineering over social media platforms to conduct fake interviews to large campaigns of recruitment-themed phishing emails distributing links to malicious repositories could indicate an actor industrializing and scaling operations.\u00bb<\/p>\n

The disclosure comes as Yeeth Security said<\/a> it discovered three malicious VS Code extensions named \u00abByteBinTools.jupyter-powerdev-2026.6.8.vsix,\u00bb ToolCraft.jupyter-powertools-3.21.0.vsix,\u00bb and \u00abOLDev.markdown-mode-devtools-2.1.0.vsix\u00bb on the official marketplace that are dressed up as seemingly harmless Jupyter Notebook productivity tools, but are, in fact, a \u00absophisticated, multi-stage backdoor\u00bb engineered to bypass endpoint defenses.<\/p>\n

The malware supports the following functions \u2013<\/p>\n