Loading story…
A cyber campaign targeted blockchain developers through a fake recruitment process that directed victims to a polished GitHub repository posing as a legitimate company project. Investigators found multiple hidden compromise paths in the codebase, including a malicious VSCode task that could run when the folder was opened and a trojanized npm dependency that delivered another infection route. The operation used a multi-stage chain with short-lived JWTs, behavior-based filtering on command-and-control infrastructure, and anti-analysis measures designed to frustrate defenders.
Analysis of the repository’s 574 commits uncovered four malicious artifacts and showed how the attackers blended social engineering with developer tooling abuse to gain execution on targets’ machines. Researchers reported that AI-assisted review significantly accelerated static analysis and helped reconstruct the attack chain, while human validation remained necessary to correct false assumptions during investigation, including the discovery that failed second-stage requests were tied to User-Agent filtering that expected an npm-like fingerprint rather than simple IP-based blocking.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Quarkslab published a blog post titled "From prompt to pwned: chaining LLM and web bugs to Admin." No further event details are available in the provided content beyond the publication itself.
Intrinsec published an analysis of a cyber campaign that used a fraudulent company, a fake recruitment process, and a prepared GitHub repository to target blockchain developers. The report describes hidden compromise mechanisms including a malicious VSCode task and a trojanized npm dependency, along with a multi-stage staging chain and analysis-resistant infrastructure.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026
Microsoft reported an ongoing social-engineering campaign targeting software developers with **job-themed lures** that direct victims to trojanized code repositories (including **Next.js**-branded projects and “technical assessment” materials). The repositories are designed to trigger **remote code execution** and then retrieve and execute attacker-controlled JavaScript that transitions into a **staged backdoor** with persistent **command-and-control (C2)**, aligning with tradecraft previously associated with **North Korea-linked** fake recruitment activity. Separately, researchers also disclosed a software supply-chain campaign involving **malicious NuGet packages** that targeted **ASP.NET** developers by stealing **ASP.NET Identity** data (e.g., user accounts, roles, and permission mappings) and modifying authorization logic to maintain access; one package acted as a dropper that installed a localhost proxy on `127.0.0.1:7152` to relay traffic to an external C2 resolved dynamically at runtime. Other items in the set are unrelated (e.g., generic industry commentary, venture funding news, and incident roundups) and do not add technical detail to the developer-focused repository backdoor campaign described by Microsoft.
Jun 29, 2026
A new wave of supply chain attacks has targeted developers through malicious npm packages and GitHub repositories, with attackers leveraging both automated worms and sophisticated social engineering. The npm registry was compromised by a self-replicating worm known as "Sha1-Hulud: The Second Coming," which infected over 800 packages and 27,000 GitHub repositories. The malware aimed to steal sensitive data such as API keys, cloud credentials, and authentication tokens, and it backdoored npm packages to execute malicious payloads during installation. Attackers also abused GitHub Actions workflows for command-and-control and data exfiltration, with a notable shift to using the Bun runtime for improved stealth and evasion of Node.js-focused defenses. In a related attack vector, threat actors used fake job interviews to lure developers into cloning and running seemingly benign Next.js projects from private GitHub repositories. The malicious code was hidden in the `next.config.js` file, which executed on the developer's machine during project setup, bypassing traditional dependency-based detection. This "Living off the Land" technique enabled the theft of credentials, including those for LastPass and cryptocurrency wallets, by exploiting trusted development workflows. Both incidents highlight the growing risk of supply chain attacks targeting developers through trusted tools and social engineering tactics.
Jun 29, 2026