North Korean Hackers Exploit VS Code Auto‑Run Tasks to Deploy StoatWaffle Malware

North Korean Hackers Exploit VS Code Auto‑Run Tasks to Deploy StoatWaffle Malware, Threatening Development Environments

What Happened — North Korean threat actors (attributed to the “Contagious Interview”/WaterPlum campaign) have begun embedding malicious tasks.json files in Microsoft Visual Studio Code projects. When a developer opens the project, VS Code automatically executes the task, silently downloading and installing the StoatWaffle malware family. The technique has been observed in the wild since December 2025 and represents a novel supply‑chain abuse of a widely‑used development tool.

Why It Matters for TPRM —

• Development tools are often trusted “zero‑trust” entry points; a compromise can give attackers footholds inside otherwise hardened networks.
• Third‑party code repositories and shared VS Code settings become attack vectors, expanding the attack surface beyond traditional endpoints.
• The stealthy nature of the auto‑run task makes detection difficult, increasing the risk of credential theft, data exfiltration, and lateral movement.

Who Is Affected — Technology/SaaS vendors, financial services firms, healthcare IT departments, and any organization that allows developers to use VS Code or shared project templates.

Recommended Actions —

• Enforce code‑signing and integrity checks for all VS Code extensions and workspace files.
• Disable automatic task execution in VS Code or require manual approval for tasks.json scripts.
• Deploy endpoint detection and response (EDR) rules that flag creation or execution of suspicious tasks.json files.
• Conduct a review of third‑party code repositories for malicious payloads and educate developers on supply‑chain hygiene.

Technical Notes — The abuse leverages VS Code’s built‑in task runner (defined in tasks.json) to execute PowerShell or Node.js commands that download the StoatWaffle payload. No specific CVE is cited; the vector is a mis‑use of a legitimate feature. The malware is capable of credential dumping, keylogging, and establishing persistence via scheduled tasks. Source: The Hacker News