Void Dokkaebi Fake Job Lure Spreads Malware

Void Dokkaebi (also known as Famous Chollima), a North Korea-aligned threat actor, has shifted tactics toward a worm-like propagation model targeting the software development ecosystem. By posing as recruiters for AI or cryptocurrency firms, the group lures developers into cloning repositories that exploit VS Code workspace trust settings. Once a developer is compromised, the actor actively weaponizes the victim's own repositories to infect downstream projects, affecting organizations like DataStax and Neutralinojs.

The technical execution involves two primary flows: a passive vector using malicious `.vscode/tasks.json` configurations and an active vector using obfuscated JavaScript injection. The actor uses a specialized batch script to rewrite Git history and forge timestamps, making malicious commits appear legitimate. Infrastructure is bolstered by blockchain-based staging via Tron, Aptos, and Binance Smart Chain, making payload delivery resilient against traditional takedowns.

This campaign represents a significant shift in supply-chain risk, moving from build-server compromises to exploiting the inherent trust within developer workflows. Organizations in cryptocurrency, AI, and open-source development are at high risk, as infected repositories can bypass CI/CD security checks and automated scanning environments.