[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsIgEl64X_Lfwhq2EJG6dG6G9fcMvd0uiIW6bfRaPXIE":3},{"article":4,"iocs":53,"watch_terms":63,"solutions":64,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"47539bf7-f5ae-446c-ace8-649a84a8a729","North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages","north-korean-hackers-steal-developer-credentials-to-inject-malware-into-github-a-cd1ad3","A North Korea-aligned hacking group has moved beyond fake job interviews and now steals developer credentials to plant malware in trusted software projects. The group, tracked as DeceptiveDevelopment, used the stolen access to change code in public and private repositories between April and September 2026. Every poisoned project then became a new way into the […] The post North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages appeared first on Cyber Security News.","A North Korea-aligned hacking group called DeceptiveDevelopment has escalated from fake job interview lures to stealing developer credentials and injecting malware directly into trusted GitHub repositories and software packages (npm, PyPI, Go, Packagist) between April and September 2026. The attackers use stolen Git credentials and SSH keys to add malicious code to repositories, then hide their changes by rewriting commit history. The compromised packages distribute malware including OmniStealer (infostealer) and DEV#POPPER (remote access trojan) to downstream users, while using blockchain-based command-and-control infrastructure to evade takedown.","North Korean DeceptiveDevelopment group steals developer credentials to inject malware into GitHub and software","https:\u002F\u002Fcybersecuritynews.com\u002Fnorth-korean-hackers-2\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FNorth-Korean-Hackers-Steal-Developer-Credentials-to-Inject-Malware-Into-GitHub-and-Software-Packages.webp","2026-10-30T15:15:02+00:00","2026-10-30T16:00:07.076244+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"DeceptiveDevelopment","threat_actor",{"name":21,"type":19},"North Korea",{"name":23,"type":24},"npm","technology",{"name":26,"type":24},"PyPI",{"name":28,"type":24},"GitHub",{"name":30,"type":31},"VS Code","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60],{"type":47,"value":55,"context":56},"OmniStealer","Python-based infostealer targeting browser logins, crypto wallets, password managers, and developer secrets; runs cross-platform",{"type":47,"value":58,"context":59},"DEV#POPPER","Remote access trojan written in Node.js; injects into VS Code, Cursor, Discord to persist across application restarts",{"type":47,"value":61,"context":62},"NullReceive","npm package loader that uses Ethereum blockchain transactions to retrieve C2 server IP addresses",[30],{"controls":65,"vendors":145},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":96,"name":97,"problem":98,"products":99},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":117,"vendor_name":28,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":124,"name":125,"problem":126,"products":127},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":117,"vendor_name":28,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},[146,152],{"slug":147,"name":148,"logo_path":149,"roles":150},"eset","ESET","\u002Fvendor-logos\u002Feset.png",[151],"reported_by",{"slug":117,"name":28,"logo_path":118,"roles":153},[154],"affected",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":167},"north-korean-hackers-hijack-developer-credentials-to-poison-open-source-packages","North Korean Hackers Hijack Developer Credentials to Poison Open-Source Packages","DeceptiveDevelopment compromised developer Git credentials and SSH keys — likely harvested through fake job lures — to inject malware directly into trusted open-source repositories on GitHub, npm, PyPI, Go, and Packagist. By rewriting commit history, attackers erased forensic evidence of their tampering, making detection extremely difficult for both maintainers and downstream consumers. This is a textbook software supply chain attack: once a trusted package is poisoned, every developer or system that installs it becomes a victim without ever interacting with the attacker directly. The use of blockchain-based C2 infrastructure further complicates takedown efforts, extending the window of compromise. This incident underscores that developer credentials are high-value targets and that implicit trust in public repositories is a dangerous assumption.",[160,161,162,163,164,165,166],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management",{"MITRE ATT&CK T1566: Phishing":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"CIS Control 17: Incident Response Management":170,"OWASP A06:2021 Vulnerable and Outdated Components":171,"CIS Control 14: Security Awareness and Skills Training":172,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":173,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":174},"The initial credential theft began with fake job interview lures — a spear-phishing technique — making phishing awareness and controls the first line of defense against this attack chain.","Continuous integrity verification of software artifacts and dependencies — a control under flaw remediation — would have detected the introduction of malicious code into packages before downstream distribution.","A documented incident response plan covering supply chain compromise scenarios — including rapid package removal, credential revocation, and downstream user notification — is essential to limit damage once poisoned packages are discovered.","This attack exploited the implicit trust developers place in public package ecosystems; OWASP A06 directly calls for verifying the integrity and provenance of all third-party components used in software builds.","Developers targeted by fake recruiter approaches need specific training to recognize social engineering lures so they do not hand over credentials or execute malicious code during a 'technical interview.'","Tracking and vetting open-source dependencies for known vulnerabilities and unauthorized modifications aligns with technical vulnerability management, which would have surfaced the tampered packages.","Enforcing MFA and strict lifecycle management of SSH keys and personal access tokens on source control platforms would have prevented stolen credentials from being used to push malicious commits."]