Skip to main content
AVOID.NET

UNK_DeadDrop North Korea Developer Phishing Campaign

avoid.net/unk-deaddrop-north-korea-developer-phishing-campaign→0/100·93% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Last changed 2026-10-27 · Re-researched — Re-researched in full by the investigator agent; the text was rewritten from new research. Version history →

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·3Ubgew…uruL
Submit evidenceRecently updated. Know something it missed? Send it in.

Summary

UNK_DeadDrop is Proofpoint's tracking designation for a threat cluster it assesses as likely North Korea-aligned, which over about six weeks in April and May 2026 sent more than 250 phishing emails to software developers at roughly 100 organizations, with a focus on cryptocurrency firms. Fake job offers and code-review requests led victims to actor-controlled GitHub and GitLab repositories that, once opened in VS Code or Cursor, deployed cross-platform malware including a modified Overlord Go framework and a persistent malicious VS Code extension (VSIX) built to steal cryptocurrency wallets, browser credentials and API tokens. Proofpoint disclosed the campaign on June 8, 2026 and tracks it separately from the Contagious Interview cluster despite substantial overlap; no government attribution or sanctions specifically naming UNK_DeadDrop had been published as of the reports.

Connected Entities

8 entities · 60 linked investigations
Organizations
□TraderTraitor / UNC48990□UNK_DeadDrop North Korea Developer Phishing Campaign□Citrine Sleet / AppleJeus0□Ledger Live94□Phantom Wallet86□UNK_DeadDrop□Electrum
Protocols
⌂Ondo Finance61
Relationships
  • UNK_DeadDrop North Korea Developer Phishing Campaign→mentioned with→Electrum(60%)
  • UNK_DeadDrop North Korea Developer Phishing Campaign→mentioned with→Phantom Wallet(60%)
  • UNK_DeadDrop North Korea Developer Phishing Campaign→mentioned with→UNK_DeadDrop(70%)
  • UNK_DeadDrop North Korea Developer Phishing Campaign→mentioned with→TraderTraitor / UNC4899(60%)
  • UNK_DeadDrop→mentioned with→Ondo Finance(80%)
  • UNK_DeadDrop North Korea Developer Phishing Campaign→mentioned with→Ledger Live(80%)
  • UNK_DeadDrop North Korea Developer Phishing Campaign→mentioned with→Ondo Finance(80%)
  • TraderTraitor / UNC4899→mentioned with→Citrine Sleet / AppleJeus(80%)
  • UNK_DeadDrop North Korea Developer Phishing Campaign→mentioned with→Citrine Sleet / AppleJeus(80%)
Also appears in
LayerZero Protocol·62Mastra AI npm Supply Chain Attack (June 2026)·0DPRK Lazarus April 2026 $635M Blitz — Drift + Kelp Combined Campaign·0fake Ledger Live app·0Leva Heal Limited (Fake Ledger Live App - Apple App Store)·2DMM Bitcoin·50Citrine Sleet / AppleJeus·0AudiA6·0Famous Chollima ClickFake Interview Campaign (PylangGhost / GolangGhost)·0June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·8

Connected Through

6 shared actors · 97 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about UNK_DeadDrop North Korea Developer Phishing Campaign?

Timeline(6 events)

April 2026

Campaign begins (approximate; exact start date not publicly specified): UNK_DeadDrop starts sending phishing emails to developers with fake job-offer and code-review pretexts, directing targets to malicious GitHub and GitLab repositories.

Proofpoint Threat Research

April 2026

Lure emails impersonate at least seven legitimate companies, including Ondo Finance, Empower Pharmacy, NXLog, OnePlan, Hypen Connect, Valon and Nourish.

Proofpoint Threat Research

May 2026

In later May 2026, lures shift to peer code-review requests from fictional cryptocurrency and AI firms Pulsynk and Trixauvex, plus ERC-4626 smart-contract testing and AI payment agent themes.

Proofpoint Threat Research

May 2026

Campaign ends (approximate): by the end of May 2026 more than 250 phishing emails had been sent to individuals at approximately 100 organizations over a six-week window.

Proofpoint Threat Research; The Register

June 2026

Proofpoint publicly discloses the UNK_DeadDrop campaign in a threat-insight post describing its techniques, impersonated companies, Overlord framework, VSIX persistence and likely North Korean attribution.

Proofpoint Threat Research

June 2026

The Register, Infosecurity Magazine, CybersecurityNews, TechRadar, SC Media and other outlets publish coverage of the Proofpoint disclosure.

The Register
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain14 Wayback Archives

Decision Log

  • #3review approveRecorded on Solana ✓6/15/2026, 12:11:58 AM
    slot 426522774 · hash 4wub2dG9BpzGMvW7MTJzg2DubkjJHWiYA3UnQLSmmiMa
  • #2reviewRecorded on Solana ✓6/15/2026, 12:11:58 AM
    slot 426522771 · hash GEZiFu2hYT5H2bMyqEybZX47b8eorpHH8NSBXEkrLCVh
  • #1publishRecorded on Solana ✓6/14/2026, 5:03:52 PM
    slot 426458080 · hash D7vU3e1abLVsqbAnzhJchcfExCTpWrdXXwnoaad86YTt

This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 14 of 14 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-code-merge-writer

generated: 6/14/2026, 5:03:44 PM

last updated: 10/27/2026, 4:29:50 AM

3 views

avoid.net — verified advice for a post-truth world