Loading threat actor…
TaskJacker is a North Korea-linked intrusion cluster associated with the broader Contagious Interview activity. It overlaps with and appears to merge into operations tracked as PolinRider, which target software developers and cryptocurrency-sector personnel through trusted developer ecosystems and recruiter-themed social engineering. The cluster is notable for compromising public GitHub repositories at scale and inserting malicious Visual Studio Code task configurations into existing projects so that code can execute automatically when a victim opens the folder in compatible development environments. The activity has been tied to widespread tampering of legitimate repositories, including modification of maintainer-controlled projects and publication of infected package versions through compromised maintainer access. Operators have been assessed to gain access through account recovery abuse or related takeover paths rather than direct theft of GitHub credentials in the observed cases. The cluster also uses obfuscated JavaScript loaders hidden inside legitimate repositories and developer configuration files, with execution chained through developer tooling. Follow-on payload delivery has been linked to DEV#POPPER RAT and OmniStealer, enabling remote access and theft of victim data. TaskJacker-linked operations have demonstrated defense-evasion tradecraft, including concealment of malicious code within padded content or disguised assets and rewriting Git history so malicious changes appear to originate from legitimate authors. The broader campaign has used fake recruiters, front companies, and collaboration lures on professional and developer platforms to gain initial execution. Known related clusters and aliases include TaskJacker, PolinRider, Contagious Interview, and overlaps with Fake Font.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.