MalwareUsed by 1 actor

DEVSPOPPER

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Contagious Interview

The delivered payload is a variant of the DEVSPOPPER remote access trojan, a cross-platform Node.js-based tool. It connects to a command-and-control server via WebSocket and uses HTTP for file exfiltration.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1204.002Malicious FileEvidence1

These repositories look like legitimate projects but carry hidden malicious code that runs the moment the developer opens the folder.

Persistence

1 technique

T1546Event Triggered ExecutionEvidence1

The first abuses Visual Studio Code workspace files, specifically a hidden file called .vscode/tasks.json, configured to run automatically when the developer opens the project folder. When the developer accepts the workspace trust prompt, the malicious task executes without further interaction, fetching a backdoor from a remote URL or launching a disguised file inside the repository carrying the payload.

Privilege Escalation

1 technique

T1546Event Triggered ExecutionEvidence1

Stealth

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

The RAT detects and avoids CI/CD environments and cloud sandboxes, running only on real developer workstations, so automated pipeline scanning will miss it.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

The RAT detects and avoids CI/CD environments and cloud sandboxes, running only on real developer workstations, so automated pipeline scanning will miss it.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

It connects to a command-and-control server via WebSocket and uses HTTP for file exfiltration.

T1219Remote Access ToolsEvidence1

The delivered payload is a variant of the DEVSPOPPER remote access trojan, a cross-platform Node.js-based tool.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

It connects to a command-and-control server via WebSocket and uses HTTP for file exfiltration.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app22 days ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Apr 24, 2026

Void Dokkaebi Hackers Use Fake Job Interviews to Spread Malware via Code Repositories

A cross-platform Node.js-based remote access trojan used to compromise developer workstations. It communicates with C2 over WebSocket, uses HTTP for file exfiltration, supports multi-operator sessions, and is designed to avoid CI/CD environments and cloud sandboxes so it runs primarily on real developer machines.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.