North Korean APT Unleashes DEV#POPPER RAT via GitHub to Drain Crypto Wallets

eSentire’s TRU uncovered DEV#POPPER, a sophisticated North Korean APT-linked campaign that lures developers to a malicious GitHub repo ("ShoeVista") whose hidden script retrieves obfuscated payloads from blockchain transactions to deploy a cross-platform RAT and OmniStealer targeting crypto wallets, developer credentials, and cloud tokens; the malware uses anti-analysis and environment checks, persists by injecting into Node.js applications (e.g., VS Code, Discord), exfiltrates data to C2 or Telegram, and eSentire published DEV#STOPPER.js to assist deobfuscation.