Void Dokkaebi VSCode Workspace Task Auto-Execution DEV#POPPER RAT

Emiliano Mema@Nosalva

•updated Aug 28, 2026•1•0•5

Detects the abuse of Visual Studio Code (and compatible IDEs like Cursor) workspace trust to trigger malicious tasks upon opening a folder. This pattern is associated with the 'Void Dokkaebi' (Famous Chollima) threat group's propagation of the 'DEV#POPPER' RAT. The rule identifies instances where the code editor spawns common scripting or network utilities (like PowerShell, curl, or Node.js) with command-line arguments indicative of file downloads or execution, as defined in a local '.vscode/tasks.json' file.