North Koreans Target Devs Worldwide With Spyware, Job Offers

DEV#POPPER, a campaign linked to North Korean threat actors, lures software developers with faux interview npm-style ZIP packages that execute obfuscated JavaScript to deploy a multi-platform infostealer (Windows, Linux, macOS). The malware chain fetches additional payloads including Python-based stealers that exfiltrate files, browser cookies, credit-card data, and keylogs, uses C2 infrastructure and host identifiers, and employs directory-traversal and filtering to appear legitimate; the campaign has expanded globally and presents substantial risk to targeted developers and their employers.