Loading threat actor…
PolinRider is a North Korea-linked software supply-chain campaign associated with Contagious Interview and Lazarus-linked activity. It targets software developers, open-source maintainers, and cryptocurrency-sector personnel through malicious developer tools, compromised repositories, and infected software releases. Linked malicious npm packages date to May 2025, while widespread repository propagation was documented in 2026. Its distribution spans npm, Go modules, Composer packages, and browser extensions, with thousands of public repositories affected. The campaign conceals obfuscated JavaScript in legitimate project configuration files, whitespace-padded code, and files masquerading as fonts. Malicious VS Code tasks execute loaders when a developer opens and trusts a workspace; other loaders execute when an application imports an infected package, without requiring installation hooks. Automated propagation modifies repositories using compromised developer access, amends existing commits, and manipulates timestamps to conceal changes. Infected packages commonly retain their legitimate functionality. PolinRider uses blockchain transactions for payload delivery and command-and-control discovery. Observed chains use Ethereum, TRON, Aptos, and BNB Smart Chain, including the NullReceiver technique, which encodes infrastructure information in transaction recipient addresses. Layered decoding, encryption, fallback providers, and detached execution make delivery resilient and obscure malicious activity. Associated payloads include BeaverTail, DEV#POPPER, OmniStealer, and INVISIBLEFERRET. Their capabilities include remote command execution, credential theft, browser-cookie collection, keylogging, clipboard capture, file exfiltration, and theft of cryptocurrency-wallet and password-manager data. Persistence mechanisms vary across payload generations. GhostAction has copied PolinRider launcher techniques, but shared operation between the campaigns has not been established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
51 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
17 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.