North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware

This article covers a new malware campaign by North Korean threat actors (WaterPlum/Contagious Interview) using malicious VS Code projects to deploy the StoatWaffle malware.

• •StoatWaffle is distributed via VS Code 'tasks.json' using the 'runOn: folderOpen' option to auto-execute malware when a project folder is opened
• •The malware first checks for Node.js, installs it if absent, then launches a downloader that polls an external server for next-stage payloads
• •StoatWaffle includes a Stealer module (browser credentials, iCloud Keychain on macOS) and a RAT module with full remote command execution
• •Related campaigns include malicious npm packages spreading PylangGhost, and the PolinRider campaign injecting BeaverTail into hundreds of public GitHub repos including Neutralinojs
• •