Loading threat actor…
Fake Font is a North Korea-linked threat activity cluster associated with the broader Contagious Interview campaign targeting software developers and cryptocurrency-sector personnel. It has been observed alongside closely related clusters including PolinRider and TaskJacker, with tactical overlap centered on malicious open-source packages, compromised code repositories, and developer-tooling abuse to trigger code execution. The activity uses social-engineering lures tied to fake recruiting and collaboration opportunities, often impersonating recruiters or professional contacts to induce targets to interact with malicious code or developer resources. Operationally, the cluster has been linked to the publication of trojanized packages across software ecosystems, compromise or takeover of maintainer accounts, tampering with legitimate repositories, and insertion of obfuscated JavaScript loaders into trusted development projects. A notable technique is disguising payload components as fake font assets and concealing malicious code within repository content, including whitespace padding and developer configuration files. Execution has been triggered through abused IDE and repository mechanisms, including malicious VS Code task definitions configured to run automatically when a folder is opened. Post-compromise behavior includes modifying common JavaScript project files to append malicious code, stealthily rewriting commit history to make changes appear legitimate, and retrieving encrypted second-stage payloads from blockchain-related infrastructure. Reported follow-on malware associated with this activity includes DEV#POPPER RAT and OmniStealer, supporting remote access, credential and data theft, and broader post-exploitation objectives. The cluster is best understood as part of North Korea-aligned intrusion activity focused on developer ecosystems and cryptocurrency-adjacent targets, combining supply-chain compromise, defense evasion, persistence in trusted repositories, and theft-oriented malware deployment.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.