Don’t Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency

MITRE Techniques

• [T1566.002 ] Spearphishing Link – Victims received emails containing links to attacker-controlled GitHub/GitLab repositories masquerading as job assessments or code reviews (’emails containing links to actor-controlled GitHub repositories’).
• [T1204.002 ] User Execution: Malicious File – The campaign depended on users cloning repositories and opening them in VS Code or Cursor to trigger execution (‘clone the repository and open it in an editor such as VS Code or Cursor’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – A hidden tasks.json executed a task automatically when the folder opened (‘runOptions.runOn: “folderOpen”‘).
• [T1059.004 ] Command and Scripting Interpreter: Unix Shell – Bash scripts launched the payloads on Linux/macOS (‘/bin/bash vendor/run-update[.]sh’).
• [T1059.005 ] Command and Scripting Interpreter: Visual Basic – Windows used a hidden VBS launcher to start the next stage (‘wscript[.]exe //B //Nologo vendor/run-update-hidden-launch.vbs’).
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – The Windows chain used a CMD script to decode and stage payloads (‘run-update[.]cmd’).
• [T1105 ] Ingress Tool Transfer – The malware fetched and staged additional components, including encrypted payloads and embedded binaries (‘stages three encrypted files into a staging directory’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The malicious VSIX extension persisted and reactivated on editor startup on macOS and Linux (‘the VSIX extension activates… and re-launches them if not’).
• [T1055 ] Process Injection – Windows ran inside the editor’s Electron process using a Node.js interpreter mode (‘ELECTRON_RUN_AS_NODE=1’).
• [T1027 ] Obfuscated Files or Information – The campaign used Base64, encrypted payloads, and embedded scripts to hide code (’embedded Base64-encoded payload’, ‘three encrypted files’).
• [T1112 ] Modify Registry – The Windows stealer enumerated users via registry to broaden collection (‘enumerates all Windows user profiles via registry’).
• [T1555 ] Credentials from Password Stores – The malware stole browser and keychain credentials from multiple stores (‘Safe Storage keys are then extracted’, ‘dump the entire login keychain’).
• [T1552.001 ] Unsecured Credentials: Credentials In Files – The Linux/macOS paths exported credentials to files before upload (‘Credentials are exported to e_p.txt’).
• [T1021.004 ] Remote Services: SSH – Not mentioned.
• [T1041 ] Exfiltration Over C2 Channel – Stolen data was uploaded to the C2 server over persistent WebSocket or HTTP POST channels (‘uploaded to the C&C via the persistent WebSocket connection’, ‘via HTTP POST’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – The malware deleted payloads and directories to reduce forensic traces (‘deleting malicious payloads and directories’).
• [T1106 ] Native API – The Windows and Linux/macOS chains used system interfaces and elevated components for credential access (‘COM Elevation Service’, ‘runuser’, ‘Volume Shadow Copy’).