"Hunting Lazarus Part X: DEV#POPPER Returns, Stealing Browser Credentials" published by RedAsgard. #DevPopper, #NetSupport https://redasgard.com/blog/hunting-lazarus-part10-devpopper-returns
Hunting Lazarus Part X: DEV#POPPER Returns, Stealing Browser Credentials
redasgard.com
November 14, 2026 at 10:17 AM
"Hunting Lazarus Part X: DEV#POPPER Returns, Stealing Browser Credentials" published by RedAsgard. #DevPopper, #NetSupport https://redasgard.com/blog/hunting-lazarus-part10-devpopper-returns
"Hunting Lazarus Part X: DEV#POPPER Returns, Stealing Browser Credentials (Technical Record)" published by RedAsgard. #DevPopper, #NetSupport https://redasgard.com/blog/hunting-lazarus-part10-devpopper-returns-technical-record
Hunting Lazarus Part X: DEV#POPPER Returns, Stealing Browser Credentials (Technical Record)
redasgard.com
November 14, 2026 at 10:17 AM
"Hunting Lazarus Part X: DEV#POPPER Returns, Stealing Browser Credentials (Technical Record)" published by RedAsgard. #DevPopper, #NetSupport https://redasgard.com/blog/hunting-lazarus-part10-devpopper-returns-technical-record
PolinRider's npm loaders read their C2 IP from Ethereum transactions - no republish needed to move servers. https://intel.threadlinqs.com/threat/TL-2026-5261?utm_source=bluesky #ThreatIntel #PolinRider #DEVPOPPER #OmniStealer
November 4, 2026 at 7:39 PM
PolinRider's npm loaders read their C2 IP from Ethereum transactions - no republish needed to move servers. https://intel.threadlinqs.com/threat/TL-2026-5261?utm_source=bluesky #ThreatIntel #PolinRider #DEVPOPPER #OmniStealer
DPRK's DeceptiveDevelopment steals dev creds, then rewrites git history to hide poisoned packages. https://intel.threadlinqs.com/threat/TL-2026-4837?utm_source=bluesky #ThreatIntel #OmniStealer #DEVPOPPER #NullReceiver
October 30, 2026 at 4:06 PM
DPRK's DeceptiveDevelopment steals dev creds, then rewrites git history to hide poisoned packages. https://intel.threadlinqs.com/threat/TL-2026-4837?utm_source=bluesky #ThreatIntel #OmniStealer #DEVPOPPER #NullReceiver
"North Korea Backdoored Their VS Code. npm Kept Bringing It Back." published by tarunrd77. #DevPopper, #VSCode https://medium.com/@tarunrd77/north-korea-backdoored-their-vs-code-npm-kept-bringing-it-back-6371da5e74c4
North Korea Backdoored Their VS Code. npm Kept Bringing It Back.
medium.com
October 21, 2026 at 12:07 AM
"North Korea Backdoored Their VS Code. npm Kept Bringing It Back." published by tarunrd77. #DevPopper, #VSCode https://medium.com/@tarunrd77/north-korea-backdoored-their-vs-code-npm-kept-bringing-it-back-6371da5e74c4
ChainDrop npm worm reads its C2 from an Ethereum contract - and scrapes CI runner memory for OIDC tokens. https://intel.threadlinqs.com/threat/TL-2026-3214 #ThreatIntel #DEVPOPPER #ShaiHulud #BeaverTail
October 10, 2026 at 6:16 AM
ChainDrop npm worm reads its C2 from an Ethereum contract - and scrapes CI runner memory for OIDC tokens. https://intel.threadlinqs.com/threat/TL-2026-3214 #ThreatIntel #DEVPOPPER #ShaiHulud #BeaverTail
A stolen GitHub login turned npm's trusted-publishing pipeline into a self-deleting RAT delivery chain. https://intel.threadlinqs.com/threat/TL-2026-2605 #ThreatIntel #BeaverTail #OmniStealer #DEVPOPPER
September 21, 2026 at 1:48 PM
A stolen GitHub login turned npm's trusted-publishing pipeline into a self-deleting RAT delivery chain. https://intel.threadlinqs.com/threat/TL-2026-2605 #ThreatIntel #BeaverTail #OmniStealer #DEVPOPPER
La campagna DevPopper prende di mira gli sviluppatori di software
- È stata osservata una campagna di ingegneria sociale in corso che prendeva di mira gli sviluppatori di software.
- È stata osservata una campagna di ingegneria sociale in corso che prendeva di mira gli sviluppatori di software.
Informa Pirata: informazione e notizie
La campagna DevPopper prende di mira gli sviluppatori di software
- È stata osservata una campagna di ingegneria sociale in corso che prendeva di mira gli sviluppatori di software.
t.me
August 30, 2024 at 1:04 PM
La campagna DevPopper prende di mira gli sviluppatori di software
- È stata osservata una campagna di ingegneria sociale in corso che prendeva di mira gli sviluppatori di software.
- È stata osservata una campagna di ingegneria sociale in corso che prendeva di mira gli sviluppatori di software.
Two beta npm releases in @joyfill were compromised with an import-time implant that hid payloads via blockchain transactions, leading to a 77 KB Node.js RAT and code tied to PolinRider and OmniStealer. #Joyfill #PolinRider #DEVPOPPER
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Two beta npm releases in the @joyfill namespace were found to contain an import-time JavaScript implant that uses blockchain transactions on Tron, Aptos, and BNB Smart Chain to resolve hidden payloads, with one branch leading to a 77 KB Node.js remote-access trojan. The compromised packages were @joyfill/layouts and @joyfill/components, and the recovered code overlaps with the PolinRider loader and DEV#POPPER family while also dropping related infrastructure for a Python infostealer linked to OmniStealer. #Joyfill #PolinRider #DEVPOPPER #OmniStealer
www.hendryadrian.com
July 29, 2026 at 8:15 PM
Two beta npm releases in @joyfill were compromised with an import-time implant that hid payloads via blockchain transactions, leading to a 77 KB Node.js RAT and code tied to PolinRider and OmniStealer. #Joyfill #PolinRider #DEVPOPPER
Two beta @joyfill npm packages were compromised to run a RAT at import time in Node.js, with payloads fetched via Tron, Aptos, and BNB Smart Chain. #joyfill #DEVPOPPER #NorthKorea
Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Two beta npm packages in the @joyfill namespace were compromised to deliver a DEV#POPPER-associated remote access trojan using import-time JavaScript implants and blockchain-based payload retrieval. The activity is linked to the same North Korean operation behind ViteVenom and also involved a Python infostealer tied to OmniStealer. #joyfill #DEVPOPPER #PolinRider #ContagiousInterview #ViteVenom...
www.hendryadrian.com
July 29, 2026 at 7:45 AM
Two beta @joyfill npm packages were compromised to run a RAT at import time in Node.js, with payloads fetched via Tron, Aptos, and BNB Smart Chain. #joyfill #DEVPOPPER #NorthKorea
An ongoing social engineering campaign was observed targeting software developers.
DevPopper Campaign Targets Software Developers
An ongoing social engineering campaign where threat actors use fake interviews to deliver a Python-based RAT, known as DevPopper.
blog.polyswarm.io
August 28, 2024 at 9:03 AM
An ongoing social engineering campaign was observed targeting software developers.
"Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan" published by Socket. #SupplyChain, #NPM, #DevPopper, #OmniStealer https://socket.dev/blog/joyfill-npm-beta-releases-compromised
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
socket.dev
July 28, 2026 at 11:24 PM
"Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan" published by Socket. #SupplyChain, #NPM, #DevPopper, #OmniStealer https://socket.dev/blog/joyfill-npm-beta-releases-compromised
"Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories" published by TrendMicro. #DevPopper, #VoidDokkaebi, #DPRK, #CTI https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html
April 22, 2026 at 1:30 PM
"Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories" published by TrendMicro. #DevPopper, #VoidDokkaebi, #DPRK, #CTI https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html
"Learn more about the DEV#POPPER remote access trojan and how to protect your organization from this threat." published by eSentire. #DevPopper, #OmniStealer, #DPRK, #CTI https://www.esentire.com/blog/north-korean-apt-malware-analysis-dev-popper-rat-and-omnistealer-everyday-im-shufflin
March 9, 2026 at 1:30 PM
"Learn more about the DEV#POPPER remote access trojan and how to protect your organization from this threat." published by eSentire. #DevPopper, #OmniStealer, #DPRK, #CTI https://www.esentire.com/blog/north-korean-apt-malware-analysis-dev-popper-rat-and-omnistealer-everyday-im-shufflin
"How to Get Scammed (by DPRK Hackers)" published by OZ. #ContagiousInterview, #DevPopper, #DPRK, #CTI https://medium.com/@0xOZ/how-to-get-scammed-by-dprk-hackers-b2f7588aea76
January 19, 2026 at 1:30 PM
"How to Get Scammed (by DPRK Hackers)" published by OZ. #ContagiousInterview, #DevPopper, #DPRK, #CTI https://medium.com/@0xOZ/how-to-get-scammed-by-dprk-hackers-b2f7588aea76
NullReceiver wallet-trail C2: DPRK hides IPs in Ethereum tx recipient addresses - zero files on disk. https://intel.threadlinqs.com/threat/TL-2026-1856 #ThreatIntel #PolinRider #DEVPOPPER #BeaverTail
August 4, 2026 at 6:35 AM
NullReceiver wallet-trail C2: DPRK hides IPs in Ethereum tx recipient addresses - zero files on disk. https://intel.threadlinqs.com/threat/TL-2026-1856 #ThreatIntel #PolinRider #DEVPOPPER #BeaverTail
Compromised joyfill npm packages ran a RAT on import - ignore-scripts never had a chance. https://intel.threadlinqs.com/threat/TL-2026-1805 #ThreatIntel #DEVPOPPER #OmniStealer #JADESNOW
August 1, 2026 at 12:37 PM
Compromised joyfill npm packages ran a RAT on import - ignore-scripts never had a chance. https://intel.threadlinqs.com/threat/TL-2026-1805 #ThreatIntel #DEVPOPPER #OmniStealer #JADESNOW
A compromised npm beta pulls its payload from Tron transactions - no C2 domain left to block. https://intel.threadlinqs.com/threat/TL-2026-1746 #ThreatIntel #DEVPOPPER #OmniStealer #PolinRider
July 28, 2026 at 4:35 PM
A compromised npm beta pulls its payload from Tron transactions - no C2 domain left to block. https://intel.threadlinqs.com/threat/TL-2026-1746 #ThreatIntel #DEVPOPPER #OmniStealer #PolinRider
Fake Vite npm packages hide their C2 inside Tron, Aptos and BSC transactions - takedown-proof by design. https://intel.threadlinqs.com/threat/TL-2026-1572 #ThreatIntel #ViteVenom #ChainVeil #DEVPOPPER
July 20, 2026 at 11:50 PM
Fake Vite npm packages hide their C2 inside Tron, Aptos and BSC transactions - takedown-proof by design. https://intel.threadlinqs.com/threat/TL-2026-1572 #ThreatIntel #ViteVenom #ChainVeil #DEVPOPPER
North Korea hid a RAT in fake Vite npm packages - the C2 lives on the Tron blockchain, no server to seize. https://intel.threadlinqs.com/threat/TL-2026-1570 #ThreatIntel #ChainVeil #ViteVenom #DEVPOPPER
July 20, 2026 at 10:06 PM
North Korea hid a RAT in fake Vite npm packages - the C2 lives on the Tron blockchain, no server to seize. https://intel.threadlinqs.com/threat/TL-2026-1570 #ThreatIntel #ChainVeil #ViteVenom #DEVPOPPER
North Korea is hiding malware at the bottom of your tailwind.config.js - it steals keys and wallets. https://intel.threadlinqs.com/threat/TL-2026-1143 #ThreatIntel #BeaverTail #InvisibleFerret #DEVPOPPER
July 7, 2026 at 1:16 AM
North Korea is hiding malware at the bottom of your tailwind.config.js - it steals keys and wallets. https://intel.threadlinqs.com/threat/TL-2026-1143 #ThreatIntel #BeaverTail #InvisibleFerret #DEVPOPPER
DPRK is hiding stealers in npm, Go and Packagist packages and pulling C2 straight off the blockchain. https://intel.threadlinqs.com/threat/TL-2026-1120 #ThreatIntel #DEVPOPPER #OmniStealer #BeaverTail
July 5, 2026 at 1:55 PM
DPRK is hiding stealers in npm, Go and Packagist packages and pulling C2 straight off the blockchain. https://intel.threadlinqs.com/threat/TL-2026-1120 #ThreatIntel #DEVPOPPER #OmniStealer #BeaverTail
North Korea hid a JS loader in open-source packages that fires the instant you open the repo in VS Code. https://intel.threadlinqs.com/threat/TL-2026-1111 #ThreatIntel #PolinRider #DEVPOPPER #OmniStealer
July 5, 2026 at 7:16 AM
North Korea hid a JS loader in open-source packages that fires the instant you open the repo in VS Code. https://intel.threadlinqs.com/threat/TL-2026-1111 #ThreatIntel #PolinRider #DEVPOPPER #OmniStealer