# DeceptiveDevelopment (North Korea-aligned) Steals Developer Credentials to Inject Malware Into GitHub Repositories and Software Packages

> ESET reports that North Korea-aligned DeceptiveDevelopment has moved from fake job-interview lures to broader software supply-chain compromise. The group harvests developer credentials (Git credentials, SSH keys, access tokens) and uses that access to inject malicious code into public and private repositories and packages. Malware includes the OmniStealer infostealer, the DEV#POPPER RAT and the NullReceiver loader.

- **Published:** 2026-10-30T15:57:15Z
- **Last reviewed:** 2026-10-30T15:57:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4837
- **ID:** TL-2026-4837
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Contagious Interview - G1052 (North Korea)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ESET's APT Activity Report Q2-Q3 2026 (published 2026-10-28, covering April-September 2026) states that DeceptiveDevelopment moved from fake job-interview lures to broader software supply-chain compromises, harvesting developer credentials and using that access to inject malicious code into public and private source code repositories. Per press coverage of the report (Cyber Security News, 2026-10-30), the initial compromise is a fake coding challenge or recruiter task hosted on Gitea. Malware on the victim host searches for Git credentials, SSH keys and access tokens. The operators then log in as the developer, inject malicious code into repositories and rewrite commit history to hide the changes. Affected distribution channels named in the coverage are npm, the Go module mirror, Packagist, PyPI and browser extension marketplaces. Persistence is described as hidden VS Code tasks that launch a blockchain lookup chain.

Malware named in the coverage: OmniStealer, a frequently updated multi-OS Python infostealer targeting browser logins, crypto wallets, password managers and developer secrets. DEV#POPPER is a Node.js RAT with keylogging and command execution that persists in VS Code, Cursor and Discord. NullReceiver (spelled NullReceive in the article text) is a loader that reads the command-server IP from the recipient addresses of Ethereum blockchain transactions, so C2 can be switched without shipping a package update. Infrastructure resilience comes from self-hosted Gitea instances (no central takedown point), JSONBin.io and JSONHosting for payload storage, the Pinata IPFS gateway (content-addressed), and blockchain-based C2 resolution.

Technical detail from eSentire's DEV#POPPER analysis (2026-03-05), a related campaign attributed with high confidence to North Korean state-sponsored actors: victims clone a malicious repository (named ShoeVista, posing as an eCommerce app) and running the frontend triggers a five-stage chain. Stage 1 is an obfuscated Node.js backdoor hidden with whitespace obfuscation in frontend/tailwind.config.js. Stage 2 fetches Stage 3 from C2 with an XOR-decrypted response. Stage 3 is the DEV#POPPER RAT/OmniStealer loader with anti-analysis checks. Stage 4 retrieves the RAT source from blockchain transaction data (Tron lookup, then Binance Smart Chain), and Stage 5 runs the RAT in memory. The RAT supports commands such as ss_info, ss_cb (clipboard theft), ss_upf/ss_upd (upload), ss_inz/ss_inzx (code injection into Node.js applications such as VS Code, GitHub Desktop, Discord, Cursor and Antigravity), ss_eval and ss_connect (change C2). OmniStealer targets Chromium and Firefox/Safari data, 100+ wallet extensions, desktop wallets, Git credentials and OS keystores, and exfiltrates password-protected ZIP archives over HTTP or Telegram. Anti-analysis includes crash-on-beautify, regex self-integrity checks and avoidance of cloud, CI/CD, container and sandbox environments.

A further supply-chain case reported by detections.ai: two beta releases in the @joyfill npm namespace (@joyfill/layouts and @joyfill/components) delivered DEV#POPPER, a clientCode remote-shell RAT and OmniStealer. The code executes at import time, so npm install --ignore-scripts does not stop it. Tiered C2 resolution uses Tron, Aptos and BNB Smart Chain, and persistence modifies VS Code, GitHub CLI and npm global configuration. That report links the activity to the PolinRider and Contagious Interview campaigns. Whether the Joyfill incident is part of the ESET-reported DeceptiveDevelopment activity is not stated in the sources reviewed. The ESET public summary and the news coverage list no IOCs; the network IOCs below come from the eSentire analysis of the related DEV#POPPER/OmniStealer campaign. BeaconBeagle returned no matches (HTTP 404) for any of the four C2 IPs. No CVE is assigned to this threat.

## MITRE ATT&CK

- T1583.006 Web Services
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1195.001 Compromise Software Dependencies and Development Tools
- T1078 Valid Accounts
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.006 Python
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1560.001 Archive via Utility
- T1102.001 Dead Drop Resolver

## Sources

- [North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages](https://cybersecuritynews.com/north-korean-hackers-2/)
- [ESET APT Activity Report Q2 2026 - Q3 2026](https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/)
- [eSentire TRU: North Korean APT Malware Analysis - DEV#POPPER RAT and OmniStealer](https://www.esentire.com/blog/north-korean-apt-malware-analysis-dev-popper-rat-and-omnistealer-everyday-im-shufflin)
- [Compromised Joyfill npm Packages Deliver DEV#POPPER RAT](https://detections.ai/intel-exchange/019fae12-b53b-7759-a957-114d9e140043)
- [Bogus npm Packages Used to Trick Software Developers (The Hacker News)](https://thehackernews.com/2024/04/bogus-npm-packages-used-to-trick.html)
- [North Korean Cyberspies Trick Developers Into Installing Malware With Fake Job Interviews (Beyond Identity)](https://www.beyondidentity.com/news-article/north-korean-cyberspies-trick-developers-into-installing-malware-with-fake-job-interviews)
- [Sophisticated NPM Attack: Cross-Platform Infostealer Targets Developer Systems (Technijian)](https://technijian.com/cyber-security/sophisticated-npm-attack-cross-platform-infostealer-targets-developer-systems/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4837