A North Korea-aligned hacking group has shifted its playbook from tricking individual developers into fake job interviews to something with far greater reach: stealing developer credentials outright and using them to plant malicious code directly inside public and private software repositories.

From Fake Recruiters to Supply-Chain Poisoning

The group, tracked by researchers as DeceptiveDevelopment, has spent years running social-engineering campaigns built around fake recruiters and bogus technical interview challenges, historically aiming to steal cryptocurrency wallets and browser-stored credentials from individual victims. According to a new APT Activity Report from ESET covering April through September 2026 and published on WeLiveSecurity on October 28, that approach has evolved significantly.

Rather than stopping at one compromised developer’s personal accounts, the group now uses stolen Git credentials, SSH keys, and access tokens to log in as the victim and inject malicious code directly into that developer’s own repositories — including projects used by potentially hundreds or thousands of downstream users. Attackers frequently rewrite commit history afterward, a move designed specifically to hide the tampering from teammates casually reviewing the project log.

Why Developer Machines Are the New Prize

ESET’s researchers frame this shift as a rational escalation: a single developer laptop often holds far more leverage than one stolen password ever could. Git logins, cloud API keys, and package-publishing rights on a developer’s machine can be the difference between compromising one account and compromising every downstream consumer of that developer’s published software.

The infection chain typically still begins with a familiar lure — a fake hiring task or coding challenge that asks the target to download and run a project file. Once executed, the malware scans the victim’s machine for exactly those high-value credentials: Git logins, SSH keys, and access tokens that can be reused to impersonate the developer across multiple platforms.

Where the Poisoned Code Turned Up

ESET identified tampered packages and extensions spread across a wide range of ecosystems, including:

• npm, the dominant JavaScript and Node.js package registry
• The Go module mirror used by Go developers worldwide
• Packagist, the primary PHP package repository
• PyPI, the Python Package Index
• Multiple browser extension marketplaces

Most of the affected projects were small, single-maintainer tools rather than high-profile libraries, which researchers say suggests the spread was largely automated and opportunistic rather than the product of carefully targeted selection. That’s arguably more concerning from a defensive standpoint, since it means essentially any developer with publishing access is a viable target, regardless of how prominent their project is.

The Malware Payloads: OmniStealer and DEV#POPPER

At the end of these infection chains, ESET consistently found two distinct tools working together. OmniStealer is a cross-platform Python-based infostealer, updated frequently, that targets browser-stored credentials, cryptocurrency wallets, password manager vaults, and developer secrets specifically. DEV#POPPER, meanwhile, is a Node.js-based remote access trojan with a longer research history; earlier analysis of the family showed it capable of keylogging and arbitrary remote command execution.

Newer versions of DEV#POPPER have added a persistence trick worth flagging to defenders: the malware injects itself into applications developers already open constantly throughout the workday, including VS Code, Cursor, and Discord, ensuring it relaunches automatically every time one of those programs starts.

Harder-to-Kill Infrastructure

ESET also noted that the group has invested effort into making its command-and-control infrastructure more resilient to takedown efforts, including some use of blockchain-based techniques to keep infrastructure addressable even after hosting providers or registrars intervene. That investment mirrors a broader trend among well-resourced APT groups: build infrastructure that survives individual takedowns rather than relying on infrastructure that collapses the moment one domain or IP gets flagged.

What Developers and Teams Should Do

Given the mechanics of this campaign, security teams supporting developers should prioritize a few concrete defenses:

• Treat unsolicited coding challenges or “run this and tell us what you think” recruiter tasks with heavy suspicion, especially when they arrive via direct message rather than an established hiring pipeline
• Enforce hardware-backed or short-lived credentials for Git and package-registry access rather than long-lived static tokens
• Monitor commit history for unexpected rewrites or force-pushes, particularly on projects maintained by a single developer
• Audit dependencies pulled from npm, PyPI, Packagist, and Go module sources for unexpected behavior following minor version bumps

The broader lesson from ESET’s report is that North Korean threat actors have recognized developers themselves as supply-chain infrastructure — and are now investing accordingly.