Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Key takeaways

Void Dokkaebi (aka Famous Chollima) has evolved beyond single-target social engineering into a self-propagating supply chain threat. A compromised developer’s repository becomes an infection vector for the next wave of victims, creating a worm-like propagation chain through the developer ecosystem.

The campaign spreads through trusted development workflows, using malicious VS Code tasks and

injected code that can execute during normal development activity. When compromised code reaches

organizational or popular open-source repositories, contributors, forks, and downs…