Loading threat actor…
UNK_DeadDrop is a threat activity cluster tracked by Proofpoint that targets software developers to steal credentials and cryptocurrency assets. During April and May 2026, it sent more than 250 phishing emails to individuals at nearly 100 organizations, predominantly in the United States. Targeted sectors included cryptocurrency and financial services, technology, education, business services, media, and telecommunications. Its tradecraft overlaps with the North Korea-linked Contagious Interview campaign, but it is tracked independently because of differences in delivery methods, infrastructure, and payload implementation; attribution to an established threat group remains unconfirmed. The cluster uses fabricated recruitment opportunities, code-review requests, and cryptocurrency project testing assignments to direct victims to attacker-controlled GitHub and GitLab repositories. It impersonates legitimate companies and creates fictitious startup identities. Malicious repositories abuse task automation in Visual Studio Code and Cursor to execute platform-specific payloads when a project is opened. Visual Studio Code requires trust and task approval, whereas observed Cursor execution occurred without those prompts. On macOS and Linux, the infection chain deploys modified Go-based remote access malware derived from the open-source Overlord framework. A malicious editor extension masquerading as a Google service provides persistence by relaunching the malware when the editor starts. On Windows, JavaScript and Python components execute through the editor's Electron environment to perform a single theft operation without equivalent persistence. The malware collects browser passwords, cookies, cryptocurrency wallet extensions, standalone wallet data, and protected browser secrets. On macOS and Linux, fake system password dialogs capture credentials that are subsequently used for privileged execution and extraction of Keychain or GNOME Keyring secrets. Windows payloads bypass Chromium App-Bound Encryption. Stolen information is archived and exfiltrated, and cleanup routines remove artifacts to impede investigation.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
43 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
124 indicators attributed to this actor. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.