Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The decrypted payloads then deploy remote access malware, including DEV#POPPER RAT and OmniStealer, to exfiltrate data from the compromised systems.
In prior reports using the same blockchain-C2 infrastructure and overlapping wallet addresses, the loader ultimately delivered DPRK-linked malware including DEV#POPPER RAT, OmniStealer, and BeaverTail-family payloads.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Contagious Interview ... tricks them into executing malicious code from a fake repository as part of an assessment.
It can also quietly launch a second hidden process in the background using child_process.spawn() with the windowsHide flag set to true, keeping everything out of sight on Windows systems.
PolinRider was first flagged ... as involving the threat actors implanting malicious obfuscated JavaScript payloads in hundreds of public GitHub repositories ... The latest wave, the payload functions as a JavaScript malware loader...
The malware sits quietly inside what looks like a standard Tailwind CSS configuration file... Once that obfuscated code runs, it quietly transforms into a full JavaScript malware loader operating inside Node.js.
The tasks.json catches developers using VS Code (triggering on folder open), while the injected JavaScript executes for anyone who builds or runs the project regardless of their IDE.
Contagious Interview ... tricks them into executing malicious code from a fake repository as part of an assessment.
For persistence, it injects versioned code (markers: C250617A through C250620A) into developer applications (e.g., Antigravity, VS Code, Cursor, Discord, GitHub Desktop) and creates a hidden .node_modules folder for Node.js module search order hijacking.
The appended JavaScript is obfuscated and reconstructs its real behavior at runtime... A large whitespace gap hides the malicious payload after the legitimate Tailwind configuration, making it easy to miss in code review.
The malware sits quietly inside what looks like a standard Tailwind CSS configuration file... Once that obfuscated code runs, it quietly transforms into a full JavaScript malware loader operating inside Node.js.
The loader uses hardcoded XOR keys to decrypt the material it retrieves and then runs the result directly inside Node.js using eval().
The RAT specifically detects and avoids CI/CD environments (e.g., GitLab CI, BuildBot) and cloud sandboxes, executing only on real developer workstations.
For persistence, it injects versioned code (markers: C250617A through C250620A) into developer applications (e.g., Antigravity, VS Code, Cursor, Discord, GitHub Desktop) and creates a hidden .node_modules folder for Node.js module search order hijacking.
InvisibleFerret implant (also reported as DEV#POPPER RAT and OmniStealer) for credential theft, browser-data theft, wallet exfiltration, and socket.io-based C2.
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DEV#POPPER RAT is a remote access malware deployed as a second-stage payload after BeaverTail, used to provide remote access and support data exfiltration from compromised systems.
A second-stage remote access trojan delivered by the JavaScript loader used in the PolinRider activity.
Remote access trojan associated with Famous Chollima operations and linked via the campaign marker embedded in the malicious loader.
A DPRK-linked remote access trojan reportedly delivered via the same blockchain-backed JavaScript loader infrastructure described in the poisoned package branch.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.