Executive Summary

Last week’s reporting joined two risks that often begin with developer access. Fake coding tests delivered cross-platform credential theft, while stolen developer accounts and package publishing access spread malicious code through GitHub and npm. PolinRider’s confirmed footprint rose to 4,367 repositories, and separate research connected the ChainVeil and ViteVenom package clusters to the same campaign with differing attribution confidence.

Remote employment created another path into software companies. Consensys disclosed that a consultant later linked to North Korea worked on MetaMask code for about a month, while infrastructure research mapped VPN routes, internal systems, and team-specific networks used by DPRK IT workers. Kimsuky spearphishing and separate Windows and Android surveillance tools rounded out the week.

Key Trends

1. Recruitment put developer credentials and code at risk

Elastic’s REF9403 campaign used fake recruitment and trojanized coding assignments. Payload fragments hidden in SVG flag images were reconstructed when the project ran, launching an OTTERCOOKIE-aligned JavaScript implant on Windows, macOS, and Linux. It stole browser and wallet data, collected files, monitored the clipboard, and accepted Socket.IO commands.¹

PolinRider then demonstrated what stolen developer access can enable at scale. Researchers identified 2,417 additional compromised repositories in July, bringing the confirmed total to 4,367 repositories across 2,152 owners. Configuration injection accounted for 93.9 percent of the new cases, and more than 90 percent of affected owners were individual developers.²

2. Package clusters shared infrastructure, but attribution differed

Checkmarx found seven Vite-themed npm packages linked to ChainVeil through TRON and Aptos wallets, XOR keys, loader design, and payload behavior. It assessed a common operator but did not connect that operator to North Korea.³ OpenSourceMalware later attributed ChainVeil and ViteVenom to the DPRK-linked PolinRider campaign, citing blockchain indicators it had published before the packages appeared, along with campaign markers and targeting patterns.⁴

The combined reporting supports a common technical cluster more strongly than it supports every attribution claim equally. Defenders can act on the shared wallets, keys, loader structure, and package behavior without collapsing those confidence differences.

3. IT workers reached trusted development environments

Consensys said a consultant using the alias “Tyler Knapp” was later identified through its investigation as connected to North Korea. The consultant contributed to core and mobile MetaMask code, including crypto-to-fiat functionality, for roughly one month. Consensys suspended releases and said it found no malicious code, stolen assets or data, or user impact.⁵

Stealer-log analysis separately mapped infrastructure used by DPRK fake IT workers. The records indicated routes through Russian exit nodes and VPN endpoints in the United States and Japan, linked internal networks to the Second Economy Committee, Ryonbong, and Kim Chaek University of Technology, and exposed several operational teams. A newly observed cluster labeled PUG remained unresolved.⁶

4. Spearphishing and surveillance remained active

Kimsuky impersonated diplomatic personnel and sent malicious LNK attachments with diplomatic decoys. The chains installed PebbleDash and PrxClient, added persistence and keylogging tools, and could relay command traffic to local RDP. ASEC said recent activity targeted people in the education sector.⁷

A suspected APT-C-26, or Lazarus, operation added the KKernel.exe keylogger to an existing remote-desktop surveillance platform. The service spawned an agent in the active user session, recorded keystrokes with foreground process context, and transmitted new logs every 30 seconds.⁸ S2W attributed BirdCall, a repackaged Zangi messenger, to ScarCruft. The Android spyware used Zoho WorkDrive for tasking and exfiltration and collected device data, contacts, calls, messages, directories, and files. Screenshot, microphone, and keylogging code was present but inactive in the sample.⁹

What to Watch

Run coding tests from unknown recruiters in disposable environments without browser sessions, wallets, or production tokens. Review SVG files, package import behavior, and configuration changes as executable risk. Software companies should verify remote workers throughout employment, not only at onboarding, and restrict new contractors from release systems until identity and access patterns are established.

Reports Reviewed