--- title: North Korea-Linked Hackers Target Developers via... description: North Korean threat actors are exploiting VS Code task configuration files in fake job assessment projects to deploy backdoors and malware on developer... canonical: https://daily.dev/posts/north-korea-linked-hackers-target-developers-via-malicious-vs-code-projects-1wklyk8gg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: North Korea-Linked Hackers Target Developers via Malicious VS Code Projects | daily.dev og:description: North Korean threat actors are exploiting VS Code task configuration files in fake job assessment projects to deploy backdoors and malware on developer... og:url: https://daily.dev/posts/north-korea-linked-hackers-target-developers-via-malicious-vs-code-projects-1wklyk8gg og:image: https://api.daily.dev/og/posts/1wKLyk8gG.png og:image:alt: North Korea-Linked Hackers Target Developers via Malicious VS Code Projects og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # North Korea-Linked Hackers Target Developers via Malicious VS Code Projects **[The Hacker News](https://daily.dev/sources/thn)** · 5 min read · 1 upvotes · 0 comments ## Summary North Korean threat actors are exploiting VS Code task configuration files in fake job assessment projects to deploy backdoors and malware on developer systems. The attack involves tricking developers into cloning malicious repositories and opening them in VS Code, which automatically executes hidden payloads when the project folder is opened. The campaign has evolved to include multiple fallback mechanisms, including malicious npm packages and obfuscated JavaScript that establishes persistent backdoors, deploys cryptocurrency miners, and enables remote code execution. The attacks primarily target developers in cryptocurrency, blockchain, and fintech sectors who have access to valuable financial assets and infrastructure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-rkhmxlpev) · Schneier on Security · 0 upvotes · 0 comments - [Your IDE is an Attack Vector](https://daily.dev/posts/your-ide-is-an-attack-vector-6mrqzzvv0) · DEV · 1 upvotes · 0 comments - [North Korea-Linked Hackers Use GitHub as C2 Infrastructure to Attack South Korea](https://daily.dev/posts/north-korea-linked-hackers-use-github-as-c2-infrastructure-to-attack-south-korea-kn4afxqnc) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#nodejs](https://daily.dev/tags/nodejs), [#malware](https://daily.dev/tags/malware), [#vscode](https://daily.dev/tags/vscode) [View this post on daily.dev](https://daily.dev/posts/north-korea-linked-hackers-target-developers-via-malicious-vs-code-projects-1wklyk8gg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"North Korea-Linked Hackers Target Developers via Malicious VS Code Projects","url":"https://daily.dev/posts/north-korea-linked-hackers-target-developers-via-malicious-vs-code-projects-1wklyk8gg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/north-korea-linked-hackers-target-developers-via-malicious-vs-code-projects-1wklyk8gg"},"datePublished":"2026-01-20T18:56:16.424Z","dateModified":"2026-02-27T20:22:38.420Z","description":"North Korean threat actors are exploiting VS Code task configuration files in fake job assessment projects to deploy backdoors and malware on developer...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ab8a58d10f483e7156313c5fdd3c9c2d?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ab8a58d10f483e7156313c5fdd3c9c2d?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/north-korea-linked-hackers-target-developers-via-malicious-vs-code-projects-1wklyk8gg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,nodejs,malware,vscode","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"North Korea-Linked Hackers Target Developers via Malicious VS Code Projects"}]} ```