North Korean Phishing Campaign Targets Tech Sector Employees

• •North Korean threat actor UNK_DeadDrop targeted 100 organizations in various sectors.
• •Phishing campaigns used malicious GitHub repositories to distribute cross-platform malware.
• •GitHub identified a related campaign, Jade Sleet, targeting technology industry employees.

Between April and May 2026, Proofpoint observed a North Korean threat actor, identified as UNK_DeadDrop, conducting phishing campaigns targeting nearly 100 organizations in finance, cryptocurrency, education, and technology sectors. The attack vector involved emails with links to malicious GitHub repositories that hosted cross-platform malware, including the Go framework Overlord. GitHub later reported a related social engineering campaign, Jade Sleet, which targeted technology employees through fake developer personas and malicious npm package dependencies. This campaign primarily affected accounts linked to blockchain and cryptocurrency sectors, with no GitHub or npm systems compromised. The campaigns exploit Visual Studio Code workflows and utilize malicious Visual Studio Extensions (VSIX) requiring minimal user interaction. The activity is part of a broader trend of North Korean actors targeting developers using fake recruiter personas and trojanized applications since at least 2022.