North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware
2026-03-23T19:24:10Z•2ccd321f31486e60c16223d4fe01d1e072757719f394fdd6a224accfe9720821
byovd','edr-killers'canisterwormcisadark-sworddarksworddockergithub-actionsinfostealerios-exploit-kitkevkubernetes-wiperlangflow-cve-2026-33017magento-polyshelloracle-cve-2026-21992phishingpolyShellquest-kace-cve-2025-32975signalstoatwafflesupply-chaintasks.jsontrivyvs-codewaterplumwhatsapp
What happened
A broad set of active high-impact threats and supply-chain incidents were reported: North Korean actors (WaterPlum/Contagious Interview) deliver StoatWaffle via malicious VS Code projects abusing tasks.json; multiple Trivy supply-chain compromises (malicious Docker images, GitHub Actions hijacks, CanisterWorm self-propagating npm infections) led to infostealers, worms and a Kubernetes wiper; rapid exploitation of newly disclosed flaws (Langflow CVE-2026-33017, Quest KACE SMA CVE-2025-32975) and a critical unauthenticated RCE in Oracle Identity/Web Services Manager (CVE-2026-21992); CISA added
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 2ccd321f31486e60c16223d4fe01d1e072757719f394fdd6a224accfe9720821
- Enrichment time
- 2026-03-23T19:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.