North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels

North Korean threat actors, operating under the UNK_DeadDrop campaign, are employing a sophisticated phishing technique targeting developers across numerous sectors, including finance and cryptocurrency, using malicious GitHub repositories and Microsoft Visual Studio Code (VS Code) extensions. The campaign leverages a framework called Overlord to deliver malware, primarily focused on credential theft from browser wallet extensions and desktop applications. This tactic represents a maturing approach by North Korea, moving beyond traditional social engineering to scale operations through phishing campaigns.