Suspected North Korean actors use fake ‘coding assignments’ to steal crypto

## Executive summary Proofpoint observed a suspected North Korean cluster called UNK_DeadDrop using fake recruiter messages and malicious GitHub/GitLab repos as coding assignments to infect developers across ~100 companies with cross-platform malware that exfiltrates cryptocurrency wallets and credentials; the campaign abuses VS Code/Cursor task automation and VSIX extensions for execution and persistence and leverages an Overlord Go RAT on macOS/Linux and a JavaScript infostealer on Windows.