North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages

A North Korea-aligned hacking group has moved beyond fake job interviews and now steals developer credentials to plant malware in trusted software projects.

The group, tracked as DeceptiveDevelopment, used the stolen access to change code in public and private repositories between April and September 2026. Every poisoned project then became a new way into the systems of the people who use it.

The group has been known for years for tricking developers with fake recruiters and coding tests. In earlier campaigns, it mainly wanted to steal cryptocurrency wallets and browser logins.

The new activity is bigger, because one infected developer can now put dozens or even hundreds of other users at risk.

Researchers say the change shows how much North Korean groups value developer machines. A single laptop often holds Git logins, cloud keys, and package publishing rights. That is far more useful to a criminal than one stolen password.

Analysts at ESET noted the shift in their APT Activity Report, which covers April to September 2026 and was published on October 28 on WeLiveSecurity.

North Korean Hackers Steal Developer Credentials

The report says the group moved from fake job-interview lures to wider software supply-chain compromises. ESET researchers found that the attack still starts with a lure, such as a fake hiring task that asks a developer to run a project.

The same trick was described in fake job interview challenges aimed at freelance coders. Once the developer runs the file, the malware searches the computer for Git credentials, SSH keys, and access tokens.

The attackers use these to log in as the developer and add malicious code to the victim’s own repositories. They often rewrite the commit history afterward, which helps hide their changes from teammates who check the project log.

The poisoned files then spread through the places developers trust most. ESET found affected items on npm, the Go module mirror, Packagist, PyPI, and browser extension marketplaces. Most of the hit projects were small tools kept by single developers.

This suggests the spread was automatic rather than carefully chosen, and each compromised project became a fresh entry point for everyone who downloads it.

At the end of several infection chains, ESET found two main tools. The first is OmniStealer, a Python infostealer that runs on several operating systems and is updated often.

It goes after browser logins, crypto wallets, password managers, and developer secrets. The second is DEV#POPPER, a remote access trojan written in Node.js.

Earlier DEV#POPPER research showed it could log keystrokes and run remote commands. The new versions add their code to apps developers open every day, including VS Code, Cursor, and Discord, so the malware runs again each time one of them starts.

Blockchain Tricks and Hard-to-Remove Infrastructure

The group has also worked to make its servers harder to shut down. ESET looked at npm packages that use a method publicly called NullReceiver.

The loader checks the latest transaction from a hardcoded Ethereum address. It then reads the command server’s IP address from the receiving address of an otherwise empty transfer. A NullReceiver npm campaign reported earlier this year used the same idea.

This gives the attackers a big advantage. They can switch to a new server with one new transaction and do not need to update any package.

Blockchain records also cannot be taken down. ESET also found this method inside a weaponized repository owned by a real developer and started by a hidden VS Code task.

By ESET’s tracking, this is the first case of blockchain-based server lookup built directly into a GitHub-hosted project. The hackers also moved their lures and payloads to services that are harder to remove.

Early-stage fake Web3 coding challenges were placed on Gitea, a GitHub alternative that people can host themselves, so there is no central team to report them to.

Later payloads were stored on JSONBin.io, JSONHosting, and Pinata, a gateway to the IPFS network. On IPFS, files are found by their content, so closing an account does not always remove the file.

ESET concluded that the group used these six months to reach more victims and make takedowns less painful. A wider look at blockchain command servers shows other groups are copying this approach.

Developers can lower their risk with a few habits. Never run code from a recruiter on your main work machine. Rotate Git tokens, SSH keys, and package publishing keys after any suspected infection. Review recent commits for rewritten history. Also treat unexpected blockchain traffic from build systems as a warning sign.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages appeared first on Cyber Security News.