A North Korea-linked hacking gang has expanded its reach, now targeting developers' credentials to implant malware in trusted software projects. A single laptop often contains Git logins, cloud keys, and package publishing rights—far more valuable to a criminal than a single stolen password. North Korean Hackers Exploit Developer Credentials via Fake Job-Interview Scams The report indicates that the group first employs deceptive job-interview tactics to gain access, then moves to broader software supply-chain compromises.
Developers can mitigate their risk by following these practices: never run code from a recruiter on your primary work machine, rotate Git tokens, SSH keys, and package publishing keys after any suspected infection.
Indicators of compromise (IoCs):- Type Indicator Role in the campaign Technique NullReceiver Reads the server IP from an Ethereum transaction recipient address Malware OmniStealer Python infostealer for browser data, wallets, password managers, and developer secrets Malware DEV#POPPER RAT Node.js remote access trojan that persists in VS Code, Cursor, and Discord Persistence Hidden VS Code task Launches the blockchain lookup chain from a weaponized repository Hosting service Gitea Hosts fake Web3 coding challenges Hosting service JSONBin.io, JSONHosting Host later-stage payload data Hosting service Pinata (IPFS gateway) Hosts payloads that are hard to remove Targeted platforms npm, Go module mirror, Packagist, PyPI, browser extension marketplaces Channels used to distribute poisoned code
