Executive Summary

Last week’s reporting documented several ways attackers turned familiar software and services into execution paths. A malicious npm package sat three dependencies below the package a developer chose to install. A forged BindsNET merge commit ran JavaScript when affected clones opened in VS Code-compatible editors, while trojanized macOS installers delivered OtterCookie outside the usual fake coding-test workflow.

Kimsuky reporting centered on malicious LNK files, scheduled PowerShell execution, GitHub-hosted payloads, and business-themed decoys. One campaign left opencode metadata and unreviewed placeholders in PDF lures. Rapid7 also disclosed a Linux espionage toolkit that modified HAProxy and system daemons at South Korean media and automotive organizations.

Key Trends

1. Developer compromise moved below the visible dependency and commit

SafeDep found that installing ioredis-xyz also resolved redis-type-xyz and then ulid-xyz, three layers down from the package named by the developer. The final package used a postinstall hook to start a cross-platform remote access trojan. It could inspect a host, list files, install operator-supplied binaries, and persist as MicrosoftSystem64 through a Windows scheduled task, a macOS LaunchAgent, or a Linux systemd user service. SafeDep linked the chain to Famous Chollima through the implant name, port 8010 command traffic, Hetzner hosting, and repositories owned by the previously identified whisdev persona.¹

The BindsNET compromise hid malicious files inside a forged version of an existing merge commit. An attacker used a collaborator’s credentials to force-push the commit across 20 branches, and a routine Dependabot merge carried it into master. The injected .vscode/tasks.json launched obfuscated JavaScript disguised as a FontAwesome file whenever an affected folder opened in VS Code, Cursor, or VSCodium with Node.js available. The loader recovered rotating command-server addresses from Ethereum transactions and launched a second stage that researchers could not recover.²³

The affected window ran from August 29 through September 2. BindsNET removed the injected files, restored the overwritten branches, restricted the compromised account, and strengthened branch protections. Package installations were not affected; exposure required a clone or pull of the repository during the affected period, followed by opening the folder in a compatible editor.²³

2. Contagious Interview used trojanized macOS installers

Jamf identified 14 malicious DMG and PKG samples impersonating applications such as The Unarchiver, Presentify, PDFify, and Bartender. The unsigned installers opened a legitimate application as a decoy, then fetched a staged shell-script chain from 162.0.239.85. The final JavaScript payload was OtterCookie, which provided remote access, collected browser and cryptocurrency-wallet credentials, searched for sensitive files, and monitored clipboard contents.⁴

The samples required users to bypass normal macOS protections, and the Intel-only code required Rosetta 2 on Apple silicon. Even so, the installer format gave Contagious Interview another delivery route beyond malicious repositories, VS Code tasks, and Git hooks.⁴

3. Kimsuky paired LNK execution with cloud-hosted payloads

AhnLab analyzed an LNK file disguised as a seafood ingredient purchase request for a Seoul hotel. Opening it displayed an HWP decoy, extracted PowerShell and JavaScript under C:\ProgramData, and registered a scheduled task that ran about every 14 minutes. The PowerShell collected host, user, network, and process details, uploaded them to Backblaze B2, retrieved commands from the same service, and executed them through temporary CMD files. AhnLab linked the activity to Kimsuky through code and workflow similarities with earlier LNK campaigns.⁵⁶

Genians attributed a separate set of 13 August LNK variants to Kimsuky’s Operation GitPower. The shortcuts concealed long PowerShell arguments, used hardcoded GitHub personal access tokens to retrieve decoys and payloads, and created hidden scheduled tasks named after legitimate software. Newer variants checked for analysis tools, virtualization processes, and a sandbox username; one used Pastebin as an alternate payload channel.⁷⁸

Several PDF decoys identified the opencode coding agent as their creator and producer. Unreplaced placeholders and identical creation times pointed to batch production with little review. Other decoys shared HeadlessChrome templates and were generated within minutes of one another. The automation increased the range of financial and corporate lure themes without changing the campaign’s GitHub-centered delivery chain.⁷⁸

4. Linux edge systems supported credential theft and traffic interception

Rapid7 found a Linux toolkit on systems at South Korean media and automotive organizations and attributed the activity with medium confidence to DPRK APT operators. The framework included curlRAT, an SSH credential logger, trojanized system daemons, and a modified HAProxy 2.8.12 build called ted backdoor. Rapid7 cited infrastructure associated with APT37 and operational overlap with earlier APT37 and Lazarus watering-hole activity, but did not assign the operation to one cluster.⁹

Ted backdoor ran inside HAProxy, preserved normal load-balancing traffic, and used a hardcoded URL path as a covert control channel. It could inspect decrypted HTTP requests, steal traffic metadata, inject content into selected responses, and suppress evidence in HAProxy counters and backend logs. curlRAT added command execution, reverse and interactive shells, host profiling, payload delivery, and monitoring of HAProxy state changes.⁹

Security Alliance’s weekly incident data offered a separate view of active DPRK infrastructure. It recorded a DPRK intrusion with $1.5 million in reported losses and listed six domains observed that week as confirmed DPRK or UNC1069 infrastructure. Several imitated Microsoft Teams or live-meeting services.¹⁰

5. Lazarus-linked wallets sold bitcoin through Hyperliquid

Arkham identified Lazarus-linked wallets that sold more than $30 million in bitcoin through Hyperliquid over three weeks. The wallets acquired ether and solana with the proceeds, then sent those assets to Kraken, LBank, and KuCoin. CoinDesk could not determine who controlled the receiving exchange accounts. The transfers created sanctions-screening questions for a decentralized platform that lets users trade directly from cryptocurrency wallets without conventional brokerage accounts.¹¹

What to Watch

Development teams should inspect dependency trees and lockfiles for ioredis-xyz, redis-type-xyz, and ulid-xyz, then review install-time network activity and persistence named MicrosoftSystem64. BindsNET users should check Git history for the forged commit and the injected .vscode files. A host that opened an affected clone should be treated as compromised before credentials or wallet keys are rotated.

On macOS, investigate unsigned installers that remove quarantine, open a legitimate decoy, and create ~/.task before launching Node.js. Windows monitoring should connect archive extraction and LNK execution with concealed PowerShell, hidden scheduled tasks, GitHub Raw Content, Pastebin, or Backblaze B2. Linux defenders should verify HAProxy and system-daemon binaries against trusted packages and use independent network telemetry when local logs appear incomplete.

Reports Reviewed