North Korea-Linked “Void Dokkaebi” Hackers Launch Self-Spreading Malware Targeting Global Developer Ecosystem

CyberDefender 8 mins0

In recent years, supply chain attacks have evolved beyond traditional infrastructure compromises. A newly observed campaign attributed to Void Dokkaebi (also known as Famous Chollima) demonstrates a concerning shift: developers themselves are now the primary infection vector.

Void Dokkaebi, a North Korea-aligned threat group, targets software developers with access to cryptocurrency wallets, signing keys, and CI/CD pipelines. While earlier reports highlighted their use of fake job interviews as an entry point, new findings reveal a far more dangerous second phase—self-sustaining malware propagation across repositories.

Infection paths used by Void Dokkaebi, with the first flow done via VSCode and the second via active injection

How the Attack Begins

The attack starts deceptively simple. Developers are approached by fake recruiters offering technical interviews. As part of the process, they are asked to clone and execute a repository hosted on platforms like GitHub or GitLab.

The repository appears legitimate—but hidden inside is a malicious configuration file:

  • .vscode/tasks.json configured with runOn: folderOpen
  • Once opened in Visual Studio Code and trusted, the task executes automatically
  • The payload is either downloaded remotely or embedded within disguised files

At this point, the developer’s machine is compromised.

Worm-Like Propagation Mechanism

What makes this campaign unique is its ability to spread beyond the initial victim.

1. Passive Propagation via VS Code

The malicious .vscode folder is often committed unintentionally because:

  • It is hidden by default
  • It is frequently not listed in .gitignore

When other developers clone the infected repository and open it:

  • They receive a trust prompt
  • If accepted, the malicious task executes again

This creates a chain reaction—each infected developer unknowingly spreads the malware further.

2. Active Injection and Git Manipulation

Once inside a developer’s system, attackers escalate their strategy:

  • Obfuscated JavaScript is injected into commonly ignored config files
  • Code is hidden using whitespace manipulation
  • A script (temp_auto_push.bat) rewrites Git history

The attacker:

  • Extracts original commit metadata
  • Alters the system clock
  • Amends commits with malicious code
  • Force-pushes changes using --no-verify

The result? The malicious commit appears completely legitimate.

Double Infection Strategy

In some cases, both propagation methods are used together:

  • VS Code tasks trigger execution on project open
  • Injected JavaScript executes during builds or runtime

This redundancy ensures the malware executes regardless of the developer’s workflow or tools.

Malware Delivery: DEV#POPPER RAT

The payload delivered is often a variant of the DEV#POPPER RAT:

  • Built on Node.js
  • Uses WebSocket-based command-and-control
  • Supports multiple simultaneous operators
  • Avoids execution in CI/CD environments

A notable innovation is its use of blockchain infrastructure:

  • Retrieves payloads from Tron or Binance Smart Chain transactions
  • Uses encrypted data stored in immutable blockchain records
  • Allows attackers to update payloads without modifying code

This makes detection and mitigation significantly harder.

Real-World Impact

The campaign has already affected hundreds of repositories:

  • Over 750 repositories contained injected malicious loaders
  • Nearly 400 .vscode/tasks.json files were weaponized
  • 100+ repositories showed evidence of commit tampering

Even well-known organizations were impacted, demonstrating how a single compromised developer can escalate into ecosystem-wide risk.

Why This Attack Is Different

Unlike traditional supply chain attacks:

  • No build systems are compromised
  • No zero-day vulnerabilities are exploited

Instead, the attack relies on:

  • Developer trust
  • Poor repository hygiene
  • Lack of scrutiny in config files

It behaves more like a worm—spreading through human workflows rather than software flaws.

How to Protect Against It

Organizations and developers should adopt the following measures:

  • Use isolated environments for interview tasks
  • Add .vscode/ to .gitignore
  • Enforce signed commits and block force pushes
  • Audit repositories for suspicious markers
  • Monitor unusual outbound connections (especially blockchain APIs)
  • Treat workspace trust prompts as security decisions

Endpoint security on developer machines is critical—CI/CD scanning alone is not enough.

Our Opinion: A Wake-Up Call for Developer-Centric Security

This campaign highlights a fundamental blind spot in modern cybersecurity: the over-reliance on infrastructure security while underestimating human workflows. Developers are increasingly becoming the weakest—and most exploited—link in the software supply chain.

What makes Void Dokkaebi particularly dangerous is not just its technical sophistication, but its psychological precision. It leverages trust—trust in hiring processes, trust in open-source code, and trust in familiar tools like VS Code.

The use of blockchain as a malware delivery mechanism is especially noteworthy. It signals a shift toward decentralized, resilient command infrastructures that are harder to disrupt using traditional security controls.

In our view, this is not an isolated campaign but a preview of future attack patterns. As development ecosystems grow more interconnected, attackers will continue to exploit collaboration, automation, and convenience.

The solution is not just better tools—but better habits:

  • Zero-trust principles applied to code execution
  • Stronger review culture for configuration files
  • Security awareness tailored specifically for developers

Ultimately, securing the software supply chain now means securing the developer experience itself.

CyberDefender