Executive Summary
Between April and May 2026, Proofpoint identified a likely North Korean threat cluster dubbed UNK_DeadDrop targeting close to 100 organizations in the finance, cryptocurrency, and technology sectors. The actor uses professional-looking recruitment lures and open-source project review requests to trick developers into cloning malicious GitHub or GitLab repositories.
The technical workflow abuses Visual Studio Code and Cursor IDE task automation features to execute platform-specific payloads. On macOS and Linux, the actor deploys a customized version of the Overlord Go framework, while Windows targets receive a Node.js-based pipeline. Both paths focus on exfiltrating browser credentials, system keychains, and cryptocurrency wallet data.
This campaign represents an evolution of tradecraft previously associated with the Contagious Interview activity set. By industrializing repository creation and utilizing malicious Visual Studio Extensions (VSIX) for persistence, the actors have created a highly automated and stealthy infection chain that requires minimal user interaction to compromise developer workstations.
Key Details
Threat Name
UNK_DeadDrop Phishing Campaign
Affects
—
Adversary
UNK_DeadDrop Other Adversaries and Aliases: Contagious Interview
MITRE Techniques
Malware/Tools
Overlord, AppleJeus, TraderTraitor, OtterCookie, Invisible Ferret, FlexibleFerret