A sustained phishing campaign that leverages developer recruitment and code-review lures to deliver cross‑platform malware via attacker-controlled GitHub repositories.
Tracked as UNK_DeadDrop and attributed with high confidence to a North Korea‑aligned actor, the operation targeted nearly 100 organizations across finance, cryptocurrency, education and technology by sending more than 250 tailored emails over six weeks.
The infection chain is notable for abusing legitimate developer workflows. Messages contained links to GitHub repositories presented as take‑home assessments or open‑source projects.
When opened in Visual Studio Code or the Cursor editor, the task executes platform-specific launchers that install a malicious VS Code extension (VSIX) and decode embedded payloads. Cursor, unlike VS Code, does not present a trust dialog, enabling silent execution with no user interaction.
Each repository included a hidden .vscode folder with a tasks.json configured to run on folder open.
According to Proofpoint, the campaign delivers distinct payloads per OS. On Linux and macOS the operators deploy native Go binaries derived from the open‑source Overlord C&C framework.
Those binaries implement a persistent RAT with modules for browser credential harvesting, targeted crypto‑wallet collection, and anti‑forensics cleanup.
The macOS chain includes a Mach‑O component that displays a convincing fake system dialog to harvest the user’s password, then modifies Keychain ACLs and relaunches the agent with elevated privileges to exfiltrate Safe Storage keys and full keychain data.
The Linux variant relies on Zenity dialogs and GNOME Keyring access methods, including Python-based fallback techniques, and similarly escalates privileges to extract secrets.
Windows infections follow a different architecture: the attack runs entirely within the editor’s Electron/Node runtime (ELECTRON_RUN_AS_NODE=1).
The launched pipeline decrypts three AES‑GCM‑protected payloads at runtime a Node.js agent, a wallet stealer and a credential extraction script and performs a two‑phase operation: wallet collection followed by credential theft.
The Windows stealer targets 35 wallet extension IDs and multiple standalone wallet apps; it also attempts to evade App‑Bound Encryption protections using a combination of COM elevation techniques and Volume Shadow Copy or other backup semantics for locked databases.
Unlike the persistent Linux/macOS RAT, the Windows pipeline uploads collected data to the same C2 and self‑cleans before terminating.
Proofpoint’s analysis shows the repositories were crafted to appear legitimate: professional Python/Foundry project structures, working scripts, and realistic documentation.
Themes included crypto prediction platforms, exploit archives, Foundry ERC‑4626 tests and AI payments tooling. Operators iterated builds across multiple accounts and hosted supporting pages on services such as Vercel.
Infrastructure was rapidly provisioned in April–May 2026, with domains registered through Namecheap and email delivery via services including Mailgun and MailHostBox.
A small subset of domains, including nemesis[.]work, used Advin Services LLC IPs for hosting, which are likely attacker-controlled boxes that were also used as sender IPs in early UNK_DeadDrop campaigns: 170.205.29[.]83 and 170.205.30[.]227.
UNK_DeadDrop mirrors tactics previously reported in Contagious Interview campaigns developer targeting, GitHub delivery and VS Code abuse but differs in delivery scale, the use of embedded payloads within repositories, choice of Overlord as the primary payload on Unix systems, and a silent execution technique exploiting Cursor and VSIX persistence.
These differences led Proofpoint to treat UNK_DeadDrop as a separate cluster despite tactical overlap.
This campaign highlights a growing trend: threat actors weaponizing developer tooling and trusted code‑sharing platforms to bypass traditional defenses.
Defenders should treat unsolicited repository links and recruitment‑style emails cautiously, enforce IDE trust and extension policies, restrict automatic task execution, and monitor for anomalous child processes, unexpected VSIX installs, and outbound WebSocket or HTTP POST activity to suspicious C2 endpoints.
| Indicator | Type | Description | First Seen |
| alex@contacttrixauvex[.]ink | Email address | Attacker-controlled email address | May 2026 |
| alex@mailpredicttogether[.]ink | Email address | Attacker-controlled email address | May 2026 |
| alex@predicttocareer[.]space | Email address | Attacker-controlled email address | May 2026 |
| alex@pulsynk[.]org | Email address | Attacker-controlled email address | May 2026 |
| alex@trixauvexnet[.]ink | Email address | Attacker-controlled email address | May 2026 |
| alexsnow@hr.onoplanoai[.]ink] | Email address | Attacker-controlled email address | May 2026 |
| alexsnow@hr.predicttocareer[.]space | Email address | Attacker-controlled email address | May 2026 |
| alexstone@hr.trixauvex[.]org | Email address | Attacker-controlled email address | May 2026 |
| carissae@hr.mailpulsynk[.]xyz | Email address | Attacker-controlled email address | May 2026 |
| christopher@hr.trixauvex[.]org | Email address | Attacker-controlled email address | May 2026 |
| chrisyan@hr.pulsynk[.]org | Email address | Attacker-controlled email address | May 2026 |
| emmaparker@hr.recruitvex[.]us | Email address | Attacker-controlled email address | May 2026 |
| faithtedesco@hr.mailtrixauvex[.]ink | Email address | Attacker-controlled email address | May 2026 |
| frankbloch@hr.trixauvex[.]org | Email address | Attacker-controlled email address | May 2026 |
| jamesrock@hr.trixauvexnet[.]ink | Email address | Attacker-controlled email address | May 2026 |
| jamierain@hr.contacttrixauvex[.]ink | Email address | Attacker-controlled email address | May 2026 |
| jamierain@hr.onoplanoai[.]ink | Email address | Attacker-controlled email address | May 2026 |
| jamiereed@hr.mailpredicttogether[.]ink | Email address | Attacker-controlled email address | May 2026 |
| jamiereed@hr.predicttocareer[.]space | Email address | Attacker-controlled email address | May 2026 |
| joshn@hr.recruitvex[.]us | Email address | Attacker-controlled email address | May 2026 |
| justinstone@hr.trixauvex[.]org | Email address | Attacker-controlled email address | May 2026 |
| nicoupdyke@hr.trixauvexnet[.]ink | Email address | Attacker-controlled email address | May 2026 |
| oliviaben@hr.pulsynk[.]org | Email address | Attacker-controlled email address | May 2026 |
| sam@hr.pulsynk[.]org | Email address | Attacker-controlled email address | May 2026 |
| samalt@hr.contacttrixauvex[.]ink | Email address | Attacker-controlled email address | May 2026 |
| samalt@hr.onoplanoai[.]ink | Email address | Attacker-controlled email address | May 2026 |
| samalt@hr.predicttocareer[.]space | Email address | Attacker-controlled email address | May 2026 |
| shelbysturm@hr.mailtrixauvex[.]ink | Email address | Attacker-controlled email address | May 2026 |
| sophiareed@hr.contacttrixauvex[.]ink | Email address | Attacker-controlled email address | May 2026 |
| sophiareed@hr.onoplanoai[.]ink | Email address | Attacker-controlled email address | May 2026 |
| taylorzhang@hr.pulsynk[.]org] | Email address | Attacker-controlled email address | May 2026 |
| dalbir@empowerpharmacy[.]space | Email address | Attacker-controlled email address | April 2026 |
| dianaberendi@nxlog[.]tech | Email address | Attacker-controlled email address | April 2026 |
| gusb@ondofinance[.]tech | Email address | Attacker-controlled email address | April 2026 |
| jasen@empowerpharmacy[.]space | Email address | Attacker-controlled email address | April 2026 |
| joshc@ondofinance[.]tech | Email address | Attacker-controlled email address | April 2026 |
| jovanav@nxlog[.]tech | Email address | Attacker-controlled email address | April 2026 |
| michaelw@ondofinance[.]tech | Email address | Attacker-controlled email address | April 2026 |
| neila@ondofinance[.]tech | Email address | Attacker-controlled email address | April 2026 |
| oladotuna@ondofinance[.]tech | Email address | Attacker-controlled email address | April 2026 |
| sarikasinha@nxlog[.]tech | Email address | Attacker-controlled email address | April 2026 |
| sladjanas@nxlog[.]tech | Email address | Attacker-controlled email address | April 2026 |
| valerie@empowerpharmacy[.]space | Email address | Attacker-controlled email address | April 2026 |
| vanjamirkovic@nxlog[.]tech | Email address | Attacker-controlled email address | April 2026 |
| nemesistrade[.]work | Domain | Related infrastructure | May 2026 |
| ceronet[.]work | Domain | Related infrastructure | May 2026 |
| deep-ai-guard[.]store | Domain | Related infrastructure | May 2026 |
| ceronetwork[.]org | Domain | Related infrastructure | May 2026 |
| culyrax[.]us | Domain | Related infrastructure | May 2026 |
| elsavora[.]us | Domain | Related infrastructure | May 2026 |
| optixauvex[.]us | Domain | Related infrastructure | May 2026 |
| recruitvex[.]us | Domain | Sender domain | May 2026 |
| talentnexhr[.]ink | Domain | Related infrastructure | May 2026 |
| onoplanoai[.]ink | Domain | Sender domain | May 2026 |
| trixauvexnet[.]ink | Domain | Sender domain | May 2026 |
| recruitptogether[.]xyz | Domain | Related infrastructure | May 2026 |
| contactpredicttogether[.]ink | Domain | Related infrastructure | May 2026 |
| connectptogether[.]ink | Domain | Related infrastructure | May 2026 |
| notifypulsynk[.]ink | Domain | Related infrastructure | May 2026 |
| contactpulsynk[.]ink | Domain | Related infrastructure | May 2026 |
| contacttrixauvex[.]ink | Domain | Sender domain | May 2026 |
| trixauvex[.]org | Domain | Sender domain | May 2026 |
| careertrixauvex[.]ink | Domain | Related infrastructure | May 2026 |
| cotrixauvex[.]ink | Domain | Related infrastructure | May 2026 |
| pulsynk[.]org | Domain | Sender domain | May 2026 |
| mailtrixauvex[.]ink | Domain | Sender domain | May 2026 |
| teampulsynk[.]team | Domain | Related infrastructure | May 2026 |
| careerpulsynk[.]xyz | Domain | Related infrastructure | May 2026 |
| mailpulsynk[.]xyz | Domain | Sender domain | May 2026 |
| mailpredicttogether[.]ink | Domain | Sender domain | May 2026 |
| predicttogetherrecruit[.]store | Domain | Related infrastructure | May 2026 |
| predicttogerecruit[.]store | Domain | Related infrastructure | May 2026 |
| predicttogether[.]ink | Domain | Related infrastructure | May 2026 |
| careerpredictto[.]space | Domain | Related infrastructure | May 2026 |
| togetherhire[.]fun | Domain | Related infrastructure | May 2026 |
| predictcareertogether[.]space | Domain | Related infrastructure | May 2026 |
| predicttocareer[.]space | Domain | Sender domain | May 2026 |
| nowurisch[.]fit | Domain | Sender domain | May 2026 |
| hyperdevpipline[.]org | Domain | Sender domain | May 2026 |
| asteara[.]org | Domain | Related infrastructure | April 2026 |
| doxxela[.]ink | Domain | Related infrastructure | April 2026 |
| coslyintra[.]online | Domain | Related infrastructure | April 2026 |
| valorecuiting[.]online | Domain | Sender domain | April 2026 |
| onoplainai[.]ink | Domain | Related infrastructure | April 2026 |
| raxvatange[.]ink | Domain | Related infrastructure | April 2026 |
| alphanonega[.]org | Domain | Related infrastructure | April 2026 |
| domatisc[.]ink | Domain | Related infrastructure | April 2026 |
| migadyn[.]info | Domain | Sender domain | April 2026 |
| empowerpharmacy[.]space | Domain | Sender domain | April 2026 |
| nxlog[.]tech | Domain | Sender domain | April 2026 |
| ondofinance[.]tech | Domain | Sender domain | April 2026 |
| 170.205.29[.]83 | IP address | Sender IP | April 2026 |
| 170.205.30[.]227 | IP address | Sender IP | April 2026 |
| hxxps://github[.]com/Pulsynk/pulsynk | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/Trixauvex-org/trixauvex | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/PedrinPY/rekt-db | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/sr-werney/forge-4626invariants | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/wayout4u/rekt-db | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/ziobiri/forge-4626-invariants | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/skyjum/x402-kit | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/Stomp47/rekt-db | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/mireles343/forge-4626invariants | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://gitlab[.]com/pulsynk-org/rekt-db.git | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://gitlab[.]com/trixauvex-org/x402-kit.git | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://gitlab[.]com/predict-together/forge-4626invariants.git | URL | Attacker-controlled GitHub repository | May 2026 |
| hxxps://github[.]com/rkama411/x402-kit | URL | Attacker-controlled GitHub repository | May 2026 |
| 23.137.105[.]75 | IP address | C&C IP | May 2026 |
| 35813f4401d3ad77b618275473a556eb47bfa6f4b7439dd8943b19f81aa7252e | SHA256 | settings.json | May 2026 |
| c935808147f0236c81483d7bbeda4b9d602f3595d5d4057f8115d39e222d1c4b | SHA256 | tasks.json | May 2026 |
| 4c0d9b802c075be79e9edb52d88f8dd72e6904f5c58267213745818470945c78 | SHA256 | run-update-hidden-launch.vbs | May 2026 |
| 62761f38ed194c59abe15c49f09f0ebc431ac852c965180c9327ed84d3a454fb | SHA256 | run-update.cmd | May 2026 |
| d3ebce2f05fe91a8260e87fd11a6ea17c156703d081b3f91d9bbe5fd6aeedc10 | SHA256 | gus-node-bootstrap.js | May 2026 |
| 91b9381d19b2e6a2db5cc0307167979b502731cb3fb50da684479e9ed35261aa | SHA256 | windows-agent-node.js.enc | May 2026 |
| 6cf9f7b2aa456a0b438600588df869b38d8007e28f01fa96022f9d8059f120b0 | SHA256 | windows-js-pipeline.js.enc | May 2026 |
| 2812e0847d472cb8870c94f463331dbe53b84135132b9bf5f6d84c2382be628f | SHA256 | detect_malware.py.enc | May 2026 |
| 52886aab179f26421678ff23af1b0fabf0a17ffbb534369cdbbac8008cbed8e7 | SHA256 | google-update-support.vsix | May 2026 |
| d5e9288693aa745dc89368deac677e7ea1ec81e663283af30838cdae189b7a7e | SHA256 | extension.js | May 2026 |
| 734699773e53d995f20d485eb61261033d9d00b4332b39ca26071bcd60cd352f | SHA256 | run-update.sh | May 2026 |
| e1bf1b29e6fa3525d7f32f429290a88d6ea2890e61c06574b8ff6372aa5d0667 | SHA256 | google-update-support-agent.zip | May 2026 |
| a2b9a769df84d9d3a4694bb0252a2c6a5e5f5d1a85a04565362737092bbb3a86 | SHA256 | google-update-support-linux-amd64 | May 2026 |
| bb10adac5b0124efedfe71102c1d5638135ec9e1cde8c8cb3353c5ed91bb9f81 | SHA256 | google-update-support-darwin-amd64 | May 2026 |
| 339907b44f161f57ff30819f422c552382ff437b3ae437463b4222cfe86bd943 | SHA256 | google-update-support-darwin-arm64 | May 2026 |
| 808e7154b7af2bc7a4b28d577297c55f77221c355191cbe00f9f1810b6d4a619 | SHA256 | darwin-password-prompt | May 2026 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…