Executive Summary

Last week’s reporting expanded the visible scale of DPRK access operations around developers. Ossprey mapped hundreds of Contagious Interview payload URLs and a separate Node.js RAT cluster. Other researchers documented malicious open-source packages, trojanized interview projects, compromised maintainer accounts, and GitHub personas apparently built to support fraudulent employment.

Cryptocurrency reporting focused on scale and post-theft movement. TRM attributed about two thirds of first-half losses to North Korea-linked activity, while S2W traced repeated use of mixers, bridges, swaps, exchanges, and OTC networks. Kimsuky reporting continued to favor LNK and CHM lures backed by public cloud and code-hosting services.

Key Trends

1. Contagious Interview exposed a large, mutable payload network

Ossprey identified 298 active payload URLs after malicious npm packages led researchers into a JSONkeeper dead-drop namespace. The operation delivered BeaverTail against browser, password-manager, and cryptocurrency-wallet data. A separate 36-sample Node.js RAT cluster used port 1244 with a ZT3 handshake, and researchers mapped 26 C2 servers. A live buffer-util-internal package showed that operators could rotate payloads during the investigation.¹

JFrog found Rollup-themed npm lookalikes that retrieved JSONKeeper content and launched Node.js components for remote access, browser and wallet theft, file collection, and clipboard monitoring.² Kudelski Security documented the social path into similar tooling: recruiters contacted developers through LinkedIn, WhatsApp, Discord, and CodeMentor, then pressured them to run trojanized projects. One fake Ajuna Network repository used npm install and a hidden VS Code task to start a backdoor and steal process.env secrets.³

2. PolinRider crossed package ecosystems and repository boundaries

Socket identified 162 malicious release artifacts across 108 packages and extensions linked to PolinRider, including 80 Go modules and 10 Packagist packages. Some cases involved compromised maintainer accounts and rewritten Git history. Loaders hid in configuration files or fake .woff2 files, ran through VS Code tasks, and resolved later stages through blockchain or RPC infrastructure.⁴

The affected assets extended beyond package-registry credentials. A compromised developer workstation could expose GitHub, npm, cloud, SSH, browser, and wallet secrets, then provide a route into source repositories and CI systems. This makes repository identity and release history part of the incident scope, not merely the package that first triggered detection.

3. GitHub personas supported fraudulent employment access

NorthScan identified fullstackdev0110, reo0603, and buddy0323 as a coordinated GitHub persona cluster with indicators consistent with DPRK IT worker activity. One persona reused an Indian developer’s portfolio, another person’s photograph, and contradictory identity and location data. Repeated, ordered references across unrelated historical issues suggested a shared or scripted method for manufacturing contribution history.⁵

The cluster also overlapped with proxy-interview infrastructure tied to the ghost, NeymaFullStack, and 7codewizard personas. The finding connects source-control reputation building with the same hiring channel that intrusion operators exploit through fake recruiter contact, although IT worker fraud and malware delivery remain distinct operational paths.

4. Cryptocurrency losses concentrated in infrastructure compromise

TRM recorded 207 cryptocurrency hacks and USD 972 million in losses during the first half of 2026. It attributed about USD 643 million, or 66 percent, to North Korea-linked activity, driven largely by the Drift Protocol and KelpDAO incidents. The largest losses came from keys, credentials, signing systems, and custody workflows rather than smart-contract exploits.⁶

S2W traced laundering after publicly attributed thefts involving Ronin Bridge, Horizon Bridge, Atomic Wallet, DMM Bitcoin, and Bybit. Funds moved through wallet splitting, mixers, bridges, cross-chain swaps, exchange services, OTC networks, and stablecoin conversion. THORChain, eXch, Chinese Laundromat-style brokers, and Huione-related services appeared as recurring infrastructure or settlement paths.⁷

5. Gaslight targeted both macOS data and AI-assisted analysis

Moonlock’s coverage of Gaslight described a Rust-based macOS stealer and backdoor linked to North Korean operators. It collected browser data, Terminal history, process and application lists, system profiles, and the encrypted login keychain, then used Telegram for tasking and exfiltration. The sample also embedded 38 fake system messages intended to mislead AI-assisted triage.⁸

Moonlock noted that this sample did not aggressively target wallets directly, even though its likely delivery context overlapped with prior DPRK targeting of developers, Web3 organizations, gaming companies, and fake job or meeting lures. Analysis systems should isolate untrusted sample content from model instructions.

6. Kimsuky document lures performed staged reconnaissance

AhnLab’s Korean and English monthly reports described South Korea-focused spearphishing dominated by LNK and CHM files. The chains used PowerShell, VBScript, HTA, Python, scheduled tasks, DLL side-loading, and legitimate Windows utilities to stage backdoors and infostealers.⁹¹⁰

Synaptic Systems analyzed a CHM lure that launched hidden PowerShell, decoded a VBScript bootstrap, profiled the host with WMI, uploaded folder and process inventories, and created an hourly scheduled task. The final payload appeared selective and was not returned during controlled replay.¹¹ Hauri documented a military-journal-themed LNK that used Dropbox and GitHub for VBE, batch, and PowerShell stages before collecting system details, download-directory listings, and process data.¹²

What to Watch

Run external coding assignments in disposable environments without production credentials. Record VS Code task and package-script execution, and audit repository history if a suspicious package or project ran. Credential rotation should cover source control, cloud accounts, SSH keys, registries, browser sessions, and wallets.

For Kimsuky detection, connect CHM or LNK execution with script interpreters, scheduled tasks, decoy documents, and traffic to public cloud or code-hosting services. A missing final payload does not make the reconnaissance chain benign.

Reports Reviewed