Threat Actors Expand Abuse of Microsoft Visual Studio Code

Date (as written): January 20 2026
Year: 2026
Actors (as written): threat actor operating on behalf of North Korea (DPRK)
Actor pages: threat actor operating on behalf of North Korea
Tags (as written): macOS; VS Code; Contagious Interview

Source entries (2)

Jamf Threat Labs

Threat Actors Expand Abuse of Microsoft Visual Studio Code · January 20 2026

Jamf Threat Labs published research related to the Contagious Interview campaign, which has been attributed to a threat actor operating on behalf of North Korea (DPRK).

https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/

Hackmageddon cyber attacks timelines (Paolo Passeri)

Software developers and engineering teams, specifically in the cryptocurrency, blockchain, and fintech sectors. · 20/01/2026

Researchers at JAMF reveal that North Korea-linked threat actors are targeting software developers by using malicious Visual Studio Code projects. Part of the "Contagious Interview" campaign, these attacks lure victims with fake job assessments, tricking them into cloning repositories that execute malicious JavaScript to deliver backdoors and establish remote code execution. [Date Occurred: Throughout late 2025 and early January 2026; Date Discovered: Since December 2025 with new interactions in January 2026]

https://www.hackmageddon.com/2026/02/03/16-31-january-2026-cyber-attacks-timeline/

https://thehackernews.com/2026/01/north-korea-linked-hackers-target.html

Suggest a correction on GitHub