Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Date (as written): 2026-04-21
Year: 2026

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Software developers globally, particularly those seeking employment at cryptocurrency and AI firms. Downstream victims include any developer who clones an infected repository · 21/04/2026

Researchers at Trend Micro discover Void Dokkaebi evolving "Contagious Interview" into a self-propagating worm, infecting developer repositories via VS Code workspace tasks to spread RATs and steal credentials through the software supply chain. [Date Occurred: Since at least March 2026; Date Discovered: During March 2026]

https://www.hackmageddon.com/2026/05/08/16-30-april-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/e/2PACX-1vTbUD4I3wQ1E1jETF6dbBelX6hJcQlgbij6JChX-YeotprThdKtAQeN9ejPXdVBeiQDhudcNBWK5HlY/pub?gid=1060075184&single=true&output=csv

https://www.darkreading.com/cyberattacks-data-breaches/dprk-fake-job-scams-self-propagate-contagious-interview

Trend Micro Research

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories · 2026-04-21

Our research on Void Dokkaebi’s operations uncovered a campaign that turns infected developer repositories into malware delivery channels. By spreading through trusted workflows, organizational codebases, and open-source projects, the threat can scale from a single compromise to a broader supply chain risk.

https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-uses-fake-job-interview-lure-to-spread-malware-via-code-repositories.html

Suggest a correction on GitHub