Malware - North Korea Threat Actors Spread StoatWaffle

What Happened

In a concerning development, North Korea-linked threat actors have been exploiting the auto-run feature of Visual Studio Code (VS Code) to distribute a new malware known as StoatWaffle. This malware is being spread through malicious projects that execute automatically when a user opens a folder in VS Code. The threat actor group, referred to as Team 8, has been active since late 2025, utilizing the tasks.json file to run code without the user's explicit consent. This method allows them to download and execute payloads seamlessly across various operating systems.

The Contagious Interview campaign, associated with Team 8, initially used a different malware called OtterCookie. However, they transitioned to StoatWaffle, which employs a multi-stage infection process. By leveraging a project related to blockchain as a decoy, they entice users to trust and open these malicious repositories, leading to potential system compromise.

Who's Being Targeted

The primary targets of this campaign are developers and users of Visual Studio Code, particularly those who may inadvertently open malicious projects. As this malware can execute on multiple operating systems, including Windows and macOS, its reach is broad. Users who are less familiar with security practices may be especially vulnerable to these tactics, as the malware exploits trusted environments to gain access.

This stealthy approach not only affects individual users but can also pose risks to organizations that rely on VS Code for development. The potential for widespread infection is significant, given the popularity of this code editor among developers.

Signs of Infection

Users may notice several indicators that their systems have been compromised by StoatWaffle. The malware features a Node.js loader that maintains a persistent connection to a command-and-control (C2) server, allowing attackers to execute commands remotely. Additionally, a stealer module collects sensitive information, such as credentials from web browsers and installed software details.

If users observe unusual network activity, unexpected installations, or unauthorized access to sensitive data, these could be signs of infection. The malware's ability to operate stealthily makes it crucial for users to remain vigilant and monitor their systems for any suspicious behavior.

How to Protect Yourself

To safeguard against StoatWaffle and similar malware, users should adopt several best practices. First, avoid opening projects from untrusted sources in VS Code. Always verify the authenticity of any repository before trusting it. Additionally, keeping software up to date with the latest security patches can mitigate vulnerabilities that malware exploits.

Implementing robust security measures, such as using antivirus software and enabling firewalls, is also essential. Regularly reviewing browser extensions and installed applications can help users identify and remove any potentially harmful software. By staying informed and cautious, users can significantly reduce the risk of falling victim to this sophisticated malware campaign.