Loading story…
Darktrace reported a spear-phishing campaign targeting South Korean organizations that abuses a legitimate feature in Microsoft Visual Studio Code to establish remote access without deploying traditional command-and-control infrastructure. The lures used government-themed content, delivering files described as JSE scripts disguised as Hangul Word Processor (HWPX) documents; when opened, they installed VS Code and enabled VS Code Tunnels, allowing attackers to remotely control compromised hosts over trusted Microsoft infrastructure. Darktrace assessed the activity as heavily living-off-the-land and noted it as an apparent first for DPRK-linked actors using this specific tunneling technique.
Other items in the set describe separate, unrelated activity and should not be conflated with the VS Code tunneling campaign. KnowBe4 detailed a dual-wave phishing operation that steals credentials and then weaponizes legitimate RMM tools for persistence; CybersecurityNews described a multi-stage Windows infection chain that uses LNK/PowerShell, GitHub-hosted loaders, Telegram Bot API communications, and repurposes the Defendnot tool to disable Microsoft Defender before dropping additional payloads; and The Hacker News “ThreatsDay” bulletin and Black Hills InfoSec’s “common threats” article are broad roundups/generic content rather than reporting the same South Korea VS Code incident. Darktrace’s separate blog post also discusses rapid exploitation of CVE-2025-55812 (React2Shell) against exposed Next.js/React Server Components, which is a different topic from the DPRK VS Code Tunnels intrusion activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Alongside its reporting on the South Korea-focused campaign, Darktrace released indicators of compromise and mapped the observed activity to MITRE ATT&CK techniques. The publication highlighted the campaign’s living-off-the-land tradecraft and the difficulty of detecting abuse of common developer tools.
Darktrace reported a spear-phishing campaign targeting South Korean victims in which government-themed lures delivered JSE files disguised as HWPX documents. The files installed Visual Studio Code and abused its built-in tunneling feature to give attackers remote access over trusted Microsoft infrastructure.
During the broader React2Shell exploitation wave, Darktrace observed likely North Korea–affiliated actors targeting financial-sector organizations across multiple countries. The activity included DPRK-linked tooling such as a Beavertail variant and a previously undocumented Linux implant called EtherRAT.
In a case study, attackers achieved remote code execution on an internet-facing Azure VM running Next.js shortly after it was exposed. They then staged a Go-based RAT and followed with cryptomining payloads including XMRig.
Darktrace observed its honeypot being exploited within two minutes of deployment, showing that attackers were already actively scanning for and exploiting vulnerable internet-facing systems. The activity quickly progressed from reconnaissance to scripted payload delivery, outbound beaconing, and cryptomining.
A public proof-of-concept for React2Shell appeared within 30 hours of the patch and disclosure, sharply reducing defenders’ response window. This accelerated the move from disclosure to in-the-wild exploitation.
CVE-2025-55812, dubbed “React2Shell,” was discovered and patched for affected React Server Components and exposed Next.js servers. Darktrace says this occurred on December 3, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked threat actors tied to the long-running **Contagious Interview** operation have been observed using **malicious Microsoft Visual Studio Code (VS Code) projects** as part of fake job-assessment lures, instructing targets to clone repositories from GitHub/GitLab/Bitbucket and open them in VS Code. The technique abuses VS Code `tasks.json` configuration—specifically `"runOn": "folderOpen"`—to trigger execution when a folder is opened, pulling staged payloads from attacker-controlled infrastructure (including Vercel-hosted domains) and ultimately deploying backdoors such as **BeaverTail** and **InvisibleFerret** that enable remote code execution and follow-on control. Recent iterations reportedly add multi-stage droppers embedded in task configuration content and disguised as benign files (e.g., spell-check dictionaries) to improve resilience if network retrieval fails, and include command-and-control behavior that can execute attacker-supplied JavaScript from a remote server (e.g., `ip-regions-check.vercel[.]app`). Separate reporting on North Korean APT trends indicates continued reliance on **fraudulent IT employment schemes** and recruitment-platform abuse to gain access to Western organizations, including long-term social engineering and persistent remote access via legitimate tools (e.g., *AnyDesk*, *Google Remote Desktop*) and VPN/location obfuscation. This broader pattern aligns with the same overarching tradecraft used in developer-targeted “interview” lures: leveraging hiring workflows and developer tooling to establish initial access and persistence while reducing suspicion, particularly in environments with remote-work infrastructure and developer workstations.
Jul 4, 2026
North Korea–aligned operators, including **Lazarus** (aka **HIDDEN COBRA**), are running multiple social-engineering-led intrusion campaigns aimed at stealing sensitive technology and establishing durable access. Reporting on **Operation DreamJob** describes fake job-offer lures used to compromise European drone manufacturers and defense contractors, with tooling and infrastructure designed to evade traditional defenses and support cyber-espionage against UAV-related intellectual property. Separately, a developer-focused operation dubbed **“Fake Font”** uses fake recruiter outreach and malicious GitHub repositories to trick engineers into opening projects that abuse *Visual Studio Code* automation (via `.vscode/tasks.json`) and disguised payloads (e.g., `.woff2` “font” files) to execute multi-stage malware that ultimately deploys the **InvisibleFerret** Python backdoor for credential and crypto-wallet theft and long-term access. A distinct DPRK-linked campaign reported by Darktrace targets South Korean users with spear-phishing that delivers a JSE script masquerading as an HWPX document and then abuses **VS Code tunnels** as a covert C2 channel over trusted Microsoft infrastructure, complicating detection in developer-heavy environments. Other items in the set describe unrelated activity: phishing abuse of *Vercel* to deliver remote-access tooling, exploitation of **CVE-2025-51683** (blind SQLi) in the *Mjobtime* time-tracking app to reach MSSQL `xp_cmdshell`, a hospitality-focused **DCRat** campaign using **ClickFix** and `MSBuild.exe`, a generic CSS exfiltration technique write-up, and Trend Micro research on the **PeckBirdy** LOLBins framework used by China-aligned intrusion sets—none of which are part of the DPRK developer/defense recruitment-themed operations above.
Jun 29, 2026
DPRK-linked operators expanded the **Contagious Interview** social-engineering campaign by posing as recruiters and sending developers malicious GitHub or GitLab repositories that execute malware when opened in **Visual Studio Code**. Researchers said the attack does not rely on a software vulnerability; instead, it abuses trusted developer workflows, including `.vscode/tasks.json`, `package.json`, and `Next.js` configuration files, to trigger background execution after a victim opens a project and trusts the author. In observed cases, `npm start` or a VS Code task launched a staged JavaScript payload, including code hidden in files such as `scripts/jquery.min.js`, which then contacted attacker infrastructure hosted on **Vercel** and related domains.
Aug 15, 2026