Void Dokkaebi Unmasked: The “Worm-Like” Supply Chain Threat Targeting Developers

TrendMicro researchers describe Void Dokkaebi (Famous Chollima), a North Korea-linked intrusion set that has evolved into a self-propagating developer-focused supply-chain campaign: attackers embed malicious Visual Studio Code task configurations and injected code to steal cryptocurrency credentials, signing keys, and CI/CD access, spreading across public and corporate repositories (750+ infected repos, 500+ malicious VS Code tasks, evidence of commit tampering) and using blockchain platforms for resilient payload staging.