Active Malware Campaigns in January-May 2026

What it is

OpenSourceMalware's campaign analysis for Jan–May 2026, centered on two threat actors: Lazarus Group (DPRK, active since 2009, crypto theft to fund state programs) and TeamPCP (financially motivated, cloud-native, tracked also as DeadCatx3/PCPcat/ShellForce — and notably claims its attacks publicly). The reason to act is a shared, concrete technique: .vscode/tasks.json files that auto-execute on repo open.

How it works

The core mechanism the summary underplays: when a developer clones a compromised repo and opens it in VS Code, the tasks.json runs automatically with no further interaction — no lifecycle script, no social engineering. TasksJacker exploits this directly. Payloads hide in files no reviewer inspects:

• Fake Font: node public/fonts/fa-brands-regular.woff2 — the .woff2 contains hex-encoded JavaScript, not font data, that decodes and runs BeaverTail.
• Malicious Dictionary: a spellright.dict file with ~6KB obfuscated JS mimicking the SpellRight extension's format, as a fallback if tasks.json is spotted and removed.

BeaverTail (loader) deploys InvisibleFerret, a Python backdoor stealing crypto wallets, browser credentials, and SSH keys.

The two Lazarus phases are linked by hard evidence: the same temp_auto_push.bat script and TRON C2 addresses appear in both TasksJacker and PolinRider, confirming one operation. C2 spans TRON, Aptos, and BSC — so domain seizure alone does not disrupt it.

Preconditions / Affected

• VS Code users who clone untrusted repos with Workspace Trust effectively bypassed.
• Registries: npm, PyPI, Go, Cargo, Packagist.
• TeamPCP/Trivy: a single unrevoked aqua-bot service-account PAT (retained from an incomplete rotation at Aqua Security) let attackers force-push malicious commits to 76 version tags across Trivy's GitHub Actions repos, poisoning every CI runner pulling them.

What to do

The page names specifics rather than commands — treat these as detections:

• Inspect .vscode/tasks.json in any cloned repo before opening; flag tasks that execute .woff2, .dict, or other asset files via node.
• Hunt for the IOCs that tie the campaign together: temp_auto_push.bat and the shared TRON C2 addresses.
• Audit service-account PATs for completed rotation; the Trivy incident turned on one credential that survived an incomplete rotation.
• Scrutinize JavaScript config files in incoming PRs from forks — PolinRider's payloads execute during builds but pass code review.

Caveats

Scale claims are bounded by what OpenSourceMalware tracked: 11 Contagious Interview variants across 17+ repos; only 3 PolinRider PRs actually merged to production before detection (targets included VS Code, Apache Superset, Rails, LangFlow, Expo). The Trivy description is cut off mid-sentence in the fetched text.