TasksJacker
Named by 13 kept items in this workspace.
8 items name it under threat actors and 5 under classification.key entities.
Search every workspace for TasksJacker. It matches the name as written, so it can find other things that share it.
The items that name it 13
folded into PolinRider by OpenSourceMalware; shared propagation script, blockchain addresses and decryption keys
early PolinRider-style activity, mentioned
Referenced OpenSourceMalware report title describing a DPRK attack compromising GitHub users via VS Code tasks.
Credential-harvesting DPRK campaign that compromises GitHub users via VS Code tasks; precursor phase whose stolen credentials were weaponized by PolinRider; OpenSourceMalware's March 31, 2026 report on TasksJacker shares the same wallets and XOR keys as PolinRider.
Campaign named by Paul McCarty; originally the source of credentials later weaponized by PolinRider
Credential-stealing malware/campaign that PolinRider initially weaponized (used stolen credentials); its payload (.vscode/tasks.json) has been found co-occurring with PolinRider config injections in 5 repositories (0.2% 'Both' category), notably in the FSDTeam-SAA account.
Campaign that merged with PolinRider as of Apr 12, 2026, when PolinRider expanded to 1,951 repos / 1,047 owners.
Evolution of tasks.json weaponization from social engineering to automated compromise of real GitHub accounts, injecting malicious tasks.json into existing repos and rewriting git history to backdate commits and spoof author metadata
All threat actors in this workspace.