ProofpointPublished
Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency
Excerpt
Developers to Steal Cryptocurrency | Proofpoint US
By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team
By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team
Key Findings
Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor conducting phishing campaigns using developer role recruitment or code review themes to targets in close to 100 organizations in finance, cryptocurrency, education, technology, and several other sectors. Proofpoint clusters this activity under the name UNK_DeadDrop.
The infection chain begins with emails containing links to actor-controlled GitHub repositories ho…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Proofpoint on proofpoint.com.
Mentioned in the excerpt
More from Proofpoint7
- Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesProofpoint · Published 30 Sep
- Carry-On Compromise: TA4922 Packs PackClientProofpoint · Published 25 Aug
- Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click ExploitProofpoint · Published 28 Jul
- ta458 roundpress exploitsProofpoint · Published 15 Jul
On the same topics
- MoqHao Part 1: Identifying Phishing InfrastructureTeam Cymru · Published 10 Jan 2021
- LARVA-208PRODAFT · Added 18 Oct
- Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and NotorietyMandiant (Google) · Published 14 Sep 2023
- App-Specific Password phishing and how to prevent itpushsecurity.com · Published 26 Jun 2025
