SecuriTricks - developer-targeting

Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency

Between April and May 2026, a likely North Korean threat actor conducted phishing campaigns targeting developers across nearly 100 organizations in finance, cryptocurrency, education, and technology sectors. The attacks used recruitment and code review themes, delivering emails with links to actor-…

north korea

credential theft

Published: June 8, 2026

Downloadable IOCs: 18

A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure

JINX-0164, a financially motivated threat actor active since mid-2025, has been conducting sophisticated campaigns against cryptocurrency organizations. The actor employs LinkedIn-based social engineering, posing as recruiters or business partners to deliver custom macOS malware including AUDIOFIX …

Published: May 28, 2026

Downloadable IOCs: 35

SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer

Financially motivated eCrime actors are conducting an ongoing infostealer campaign targeting software developers through SEO poisoning techniques. The operation impersonates AI platforms including Gemini CLI and Claude Code, as well as developer tools like Node.js, Chocolatey, and KeePassXC. Attack…

ai platform impersonation

fileless powershell

supply chain risk

Published: May 21, 2026

Downloadable IOCs: 34

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Void Dokkaebi, also known as Famous Chollima, has evolved its operations into a self-propagating supply chain threat targeting software developers. The North Korea-aligned group uses fabricated job interviews to lure developers into cloning malicious repositories. Once compromised, the victim's mac…

blockchain infrastructure

dev#popper rat

developer targeting

fake job interview

git history tampering

Published: April 21, 2026

Downloadable IOCs: 10

Developer-targeting campaign using malicious Next.js repositories

A coordinated campaign is targeting developers through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. The attack uses multiple entry points that lead to runtime retrieval and local execution of attacker-controlled JavaScript, transitioning into s…

javascript

node.js

remote code execution

environment variable exfiltration

Published: February 24, 2026

Downloadable IOCs: 4

Tag: developer-targeting

Attack reports

Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency

A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure

SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Developer-targeting campaign using malicious Next.js repositories