North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels

Proofpoint and other researchers uncovered large, multi-stage campaigns—codenamed UNK_DeadDrop and linked to North Korea-aligned clusters such as Contagious Interview—using malicious GitHub repositories, VS Code auto-execution, VSIX extensions, and compromised open‑source packages to deliver cross-platform loaders and malware (Overlord variants, backdoors, and infostealers) that exfiltrate credentials and cryptocurrency wallets; the activity spans recruitment-themed phishing, supply-chain npm/package abuse, and marketplace-distributed malicious extensions, affecting hundreds of targets and resulting in significant crypto theft.