Phishing crews targeted developers and enterprises to steal credentials and extort victims

Security researchers reported two active phishing operations that relied on social engineering rather than mass malware spam to compromise organizations and steal high-value data. Proofpoint said the cluster it tracks as UNK_DeadDrop, likely aligned with North Korea, targeted developers at nearly 100 organizations in cryptocurrency, finance, technology, and education. The attackers used fake recruitment, code review, and technical assessment lures to push victims to attacker-controlled GitHub and GitLab repositories, where hidden Visual Studio Code tasks and a malicious VSIX extension triggered malware on macOS, Linux, and Windows. The campaign stole browser credentials, cryptocurrency wallets, cookies, and keychain or keyring data, while maintaining persistence through the extension and removing repository artifacts to reduce detection.

A separate campaign tracked by Palo Alto Networks Unit 42 as CL-CRI-1147 and publicly associated with the Pink extortion group targeted enterprise users through voice phishing and credential theft. Researchers said Pink impersonated internal IT staff to direct employees to phishing pages that captured credentials, MFA codes, and session cookies, enabling access to Microsoft 365 services including OneDrive and SharePoint. The group then used legitimate Microsoft automation tools to exfiltrate data and sent extortion demands through compromised Microsoft Teams accounts and email, typically giving victims 72 hours to pay. Unit 42 linked Pink to the broader Com cybercriminal ecosystem and noted overlaps with groups such as Lapsus$, Scattered Spider, and ShinyHunters, while Google Threat Intelligence Group assessed it may be a rebrand of the BlackFile operation.