UNK_DeadDrop North Korea Developer Phishing Campaign
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3Ubgew…uruLSummary
UNK_DeadDrop is a suspected North Korea-aligned threat actor campaign disclosed by Proofpoint on June 8, 2026, in which attackers sent more than 250 phishing emails to software developers at approximately 100 organizations — with a heavy focus on cryptocurrency firms — over a six-week period in April and May 2026. Victims were directed to actor-controlled GitHub and GitLab repositories disguised as coding assignments or code-review projects; opening these repositories silently deployed cross-platform malware including the Go-based Overlord remote-access framework and malicious VS Code extensions (VSIX) capable of stealing browser credentials, cryptocurrency wallets, and API tokens. Proofpoint tracks UNK_DeadDrop as a distinct cluster from the previously documented Contagious Interview / Lazarus campaigns, noting industrialized repository creation and an email-first delivery model as differentiating characteristics.
Connected Entities
1 entities · 10 linked investigationsTimeline(5 events)
April 2026
Campaign start (approximate): UNK_DeadDrop begins sending phishing emails to developers using fake job-offer and code-review pretexts, directing targets to malicious GitHub and GitLab repositories.
Proofpoint Threat ResearchApril 2026
Impersonation of at least seven legitimate companies including Ondo Finance, Empower Pharmacy, NXLog, OnePlan, Hypen Connect, Valon, and Nourish observed in lure emails.
Proofpoint Threat Research31 May 2026
Campaign end (approximate): more than 250 phishing emails sent across approximately 100 organizations in a six-week window spanning April and May 2026.
Proofpoint Threat Research8 June 2026
Proofpoint publicly discloses the UNK_DeadDrop campaign in a detailed threat-insight blog post, describing the Overlord framework, VSIX persistence technique, and cross-platform malware chain.
Proofpoint Threat Research8 June 2026
The Register, Infosecurity Magazine, CybersecurityNews, TechRadar, and SC Media publish coverage of the Proofpoint disclosure, amplifying awareness to the security and developer communities.
The RegisterDecision Log
- hash: 4wub2dG9BpzGMvW7MTJzg2DubkjJHWiYA3UnQLSmmiMa
- hash: GEZiFu2hYT5H2bMyqEybZX47b8eorpHH8NSBXEkrLCVh
- hash: D7vU3e1abLVsqbAnzhJchcfExCTpWrdXXwnoaad86YTt
This investigation is cryptographically anchored to the Solana blockchain (3 events). 7 of 7 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/14/2026, 5:03:44 PM
last updated: 7/26/2026, 11:29:59 AM
3 viewsavoid.net — verified advice for a post-truth world