UNK_DeadDrop developer-recruitment phishing against close to 100 organizations (April-May 2026)

Date (as written): June 08, 2026
Year: 2026
Actors (as written): UNK_DeadDrop (very likely North Korea-aligned)
Actor pages: UNK_DeadDrop
Tags (as written): finance, cryptocurrency, education, technology

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Software developers at ~100 organizations (tech, education, finance, cryptocurrency) · 2026-06-08

Proofpoint discovers North Korea-aligned threat actor UNK_DeadDrop phishing 250+ developers at ~100 organizations via fake GitHub/GitLab repositories, deploying Go/JS RATs to steal cryptocurrency and credentials. [Date Occurred: Between April and May 2026; Date Discovered: Between April and May 2026]

https://www.hackmageddon.com/2026/06/23/1-15-june-2026-cyber-attacks-timeline/

https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/

Proofpoint Threat Insight

UNK_DeadDrop developer-recruitment phishing against close to 100 organizations (April-May 2026) · June 08, 2026

Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor conducting phishing campaigns using developer role recruitment or code review themes to targets in close to 100 organizations in finance, cryptocurrency, education, technology, and several other sectors. Proofpoint clusters this activity under the name UNK_DeadDrop.

https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal

Suggest a correction on GitHub