North Korean Hackers Steal Developers’ Credentials to Inject Malware into GitHub Repositories and Software Packages

A hacking group aligned with North Korea has shifted from using fake job interviews to directly stealing developer credentials so it can inject malware into trusted software projects.

Tracked as DeceptiveDevelopment, the group used compromised accounts to alter code in public and private repositories between April and September 2026. Each tampered project became a potential foothold into the systems of people and organizations that use it.

Researchers say DeceptiveDevelopment had previously targeted developers with bogus recruiter messages and coding tests, primarily to steal cryptocurrency wallets and browser logins. The recent campaign is larger in scale and impact: compromising a single developer now allows the attackers to put dozens or even hundreds of downstream users at risk.

Security analysts note the change underscores how valuable developer machines are to these actors. A developer’s laptop commonly contains Git credentials, cloud keys, and package publishing rights—assets far more useful to an attacker than a single password.

ESET documented the activity in its APT Activity Report covering April–September 2026, published October 28 on WeLiveSecurity.

How the group targets developers

ESET’s report describes a shift from isolated fake-interview lures to broader software supply-chain compromises. The attacks typically begin with a lure—often a fake hiring task that asks a developer to run a project locally. When the developer executes the supplied files, the malware searches the machine for Git credentials, SSH private keys, and access tokens.

Using those credentials, the attackers log in as the developer and add malicious code to the developer’s own repositories. They often rewrite commit history afterward to conceal their changes from teammates who review project logs.

The poisoned files then spread through distribution channels developers trust most. ESET found compromised packages and projects on npm, the Go module mirror, Packagist, PyPI, and browser extension marketplaces. Most of the affected projects were small utilities maintained by single developers, suggesting the propagation was largely automatic rather than the result of careful selection. Each compromised project therefore served as a new entry point for anyone who downloaded it.

At the end of several infection chains, ESET observed two primary tools. The first, OmniStealer, is a Python-based information stealer that runs on multiple operating systems and is frequently updated. OmniStealer targets browser logins, cryptocurrency wallets, password managers, and developer secrets. The second, DEV#POPPER, is a Node.js remote access trojan (RAT). Earlier analyses showed DEV#POPPER can log keystrokes and execute remote commands; newer versions persist by injecting code into applications developers open daily—such as VS Code, Cursor, and Discord—so the malware runs again each time those apps start.

Blockchain-based tricks and resilient hosting

The attackers also adopted methods to make their command infrastructure harder to disrupt. ESET investigated npm packages that implement a technique publicly called NullReceiver. The loader checks the latest transaction from a hardcoded Ethereum address and reads the command server’s IP address from the recipient address of an otherwise empty transfer. That means the threat actor can update the command-and-control IP by issuing a new blockchain transaction, without changing any hosted package.

Because blockchain records are immutable and globally visible, they cannot be taken down the way conventional hosting can. ESET found this technique used not only in npm packages but inside a weaponized repository belonging to a legitimate developer, triggered by a hidden VS Code task. According to ESET, this is the first observed instance of blockchain-based server lookup implemented directly in a GitHub-hosted project.

The attackers also moved lures and payloads to services that are harder to remove. Early fake Web3 coding challenges were hosted on Gitea, a GitHub alternative that can be self-hosted and therefore lacks a single central takedown authority. Later-stage payloads were stored on JSONBin.io, JSONHosting, and Pinata (an IPFS gateway). Files on IPFS are addressed by content, so removing an account does not necessarily eliminate access to a file.

ESET concluded that over the six-month period the group expanded its reach and made takedowns more difficult. Other threat actors have begun to adopt similar blockchain-based command-server lookup techniques.

Developers can reduce their risk by adopting a few practices: never run code sent by a recruiter on a primary work machine; rotate Git tokens, SSH keys, and package-publishing credentials after any suspected compromise; review recent commits for evidence of rewritten history; and treat unexpected blockchain traffic from build systems as a warning sign.

Indicators of compromise (IoCs)

Note: IP addresses and domains in IoC lists are often intentionally defanged (for example, using [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.