Full Report
Targets are encouraged to clone Git repositories to their VS Code or Cursor code editors.
Analysis Summary
# Threat Actor: UNK_DeadDrop
## Attribution & Identity
- **Name/Alias:** UNK_DeadDrop
- **Known Associations:** Suspected North Korean (DPRK) state-sponsored threat actors.
- **Related Groups:** Shows significant similarities to the **Contagious Interview** campaign (often associated with Lazarus Group or BlueNoroff sub-clusters).
## Activity Summary
Between April and May 2026, UNK_DeadDrop conducted a high-volume phishing campaign involving over 250 emails sent to nearly 100 organizations. The campaign leverages a "fake recruitment" theme, where attackers pose as hiring managers or talent agencies to lure developers into downloading malicious code under the guise of technical assessments or peer reviews.
## Tactics, Techniques & Procedures
- **Spear-Phishing (T1566.001):** Sending tailored emails posing as recruiters or tech startups.
- **Social Engineering:** Using legitimate company names (Ondo Finance, Nourish, Hypen Connect) to build trust.
- **Malicious Code Repository (T1195.001):** Utilizing GitHub and GitLab to host malicious projects.
- **Task Automation Abuse:**
- Abusing the `tasks.json` file in Visual Studio Code and Cursor editors.
- **Execution (T1204.002):** Automatically executing malicious commands when a folder is opened.
- **Platform-Specific Exploitation:** Exploiting the fact that the **Cursor** code editor does not prompt for user approval before executing tasks, unlike the default behavior in VS Code.
## Targeting
- **Sectors:** Technology, Education, Business Services, Financial Services, Entertainment/Media, Telecommunications, and Decentralized Finance (DeFi).
- **Geography:** Primarily focused on the United States.
- **Victims:** Specific focus on software developers within the cryptocurrency and AI industries. Agencies mentioned as impersonated include Ondo Finance, Nourish, and Hypen Connect.
## Tools & Infrastructure
- **Malware:** Cross-platform malware designed for credential theft and cryptocurrency drainage.
- **Fake Entities:** Pulsynk, Trixauvex (fake crypto/AI startups).
- **Infrastructure:**
- github[.]com (Malicious repositories)
- gitlab[.]com (Malicious repositories)
- Spoofed recruitment domains (Defanged representation of impersonated entities).
## Implications
This campaign demonstrates the continued evolution of North Korean "Social Engineering" tactics. By targeting the development environment (IDE) rather than the operating system directly, attackers bypass traditional browser-based or email-gateway security controls. The use of the Cursor editor highlights the actor's agility in identifying and exploiting security gaps in emerging developer tools. The ultimate goal remains the theft of cryptocurrency and sensitive credentials to fund the North Korean regime.
## Mitigations
- **IDE Security Configuration:** Developers should be wary of cloning repositories from untrusted sources. Ensure "Workspace Trust" features are enabled in VS Code.
- **Tool Assessment:** Organizations using the Cursor editor should be aware of its lack of task execution prompts and consider implementing restrictive execution policies.
- **Vetting Recruiters:** Verify the identity of recruiters via secondary channels (e.g., official company websites or LinkedIn) before interacting with technical "test" repositories.
- **Code Review:** Inspect hidden directories (such as `.vscode/`) for suspicious `tasks.json` or `launch.json` files before opening projects in an IDE.