North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware
2026-03-24T01:24:14Z•fb4541fb9994dee4b714e6cbc6cf0db2915bf62a4946d42d73a40cb0ab8750b5
BYOVDcanisterwormcredential-phishingdeveloper-toolingdockergithub-actionsiot-botnetnation-statercestoatwafflesupply-chaintasks.jsontrivyvs-codezero-day
What happened
A surge of high-impact activity across multiple fronts: nation-state actors (notably DPRK-linked WaterPlum) are abusing developer tooling — e.g., malicious VS Code projects using tasks.json to auto-run StoatWaffle — while large supply-chain compromises continue to hit developer ecosystems (Trivy Docker/GitHub Actions breaches, CanisterWorm affecting npm). Multiple critical and actively exploited vulnerabilities were reported including Quest KACE SMA (CVE-2025-32975), Oracle Identity Manager unauth RCE (CVE-2026-21992), and Langflow RCE (CVE-2026-33017 exploited within hours). Other notable urg
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- fb4541fb9994dee4b714e6cbc6cf0db2915bf62a4946d42d73a40cb0ab8750b5
- Enrichment time
- 2026-03-24T01:24:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.