North Korean Hackers Target macOS Developers via Malicious VS Code Projects

North Korean threat actors are abusing Visual Studio Code task configuration files for malware delivery in a campaign aimed at macOS software developers, according to Jamf. Rather than the ClickFix technique, the attackers lure victims into accessing or cloning GitHub or GitLab repositories under the pretext of a job assignment, with the malicious VS Code projects containing heavily obfuscated JavaScript.

When a repository is opened in VS Code, users are prompted to trust the project’s author, which then executes malicious commands on macOS. The shell command retrieves a JavaScript payload and pipes it into the Node.js runtime, enabling persistence, basic system information collection, and communication with a command-and-control server. The backdoor provides core functionality such as remote code execution and system fingerprinting, and can dynamically execute additional JavaScript code supplied by the C&C.

Beacons periodically send host details to the C&C and may fetch more code, potentially generated with AI assistance. 21 January 2026.