About

UNK_DeadDrop was a fake-recruitment campaign aimed at software developers. It reached its targets through job conversations that ended in one of two places: a verification page whose copy button quietly replaced the command on the clipboard, or a take-home repository that installed a malicious VS Code extension as soon as the project was opened. The articles here reconstruct that campaign from the artifacts it left behind, without running a single sample. The reconstruction follows the material from the first lure through credential and wallet collection, the infrastructure that kept the operation reachable, and the databases used to choose targets, to the detections built from what was recovered. Each article says plainly where the evidence stops.

What you will find here

This blog carries six parts of a fourteen-part series. Each was chosen because it stands on its own for a developer or analyst who arrives without the rest of the story:

• How a Malicious VSIX Uses the Signed Editor Runtime shows how a take-home repository turned the editor itself into the launcher.
• Parsing Without Executing: JavaScript Deobfuscation with Acorn recovers the extension's hidden strings and keys by reading the code rather than running it.
• Following the GitLab Dead Drop: Configuration Changes and C2 History traces how a public repository file told the malware where to report, and how that file changed over time.
• From Commit Metadata to a Developer Target List follows the public commit history that the operation harvested to decide whom to approach next.
• Building and Testing Detections for UNK_DeadDrop turns the recovered artifacts into YARA rules and shows what each rule can and cannot prove.
• Where Overlord Ends and the Collection Toolchain Begins separates the open-source framework underneath the malware from the parts the operator built on top of it.

All fourteen parts, the two papers and the research materials are on the original research site, and every article here is republished from there. The site remains the canonical version, so any correction lands there first.

How the evidence is handled

The underlying case evidence ends on 24 July 2026, and public reporting was checked through 25 October 2026. Because of that, the indicators and domains in these articles are dated historical observations rather than current verdicts, and a domain that was malicious then may belong to someone else today. The articles distinguish what code was capable of from what was actually seen to run. None of them attributes the activity to a named person or company. Raw contact databases, credentials and the full sample set stay out of the published material.

Papers and tools

The technical paper sets out the full artifact-based study behind the series. The scanner paper describes how the obfuscated JavaScript was triaged statically and how that method held up at registry scale. The detection rules and the parse-only scanner are open source in KrasForge/unk-scanner, and they were written to let other analysts inspect related files without opening them in an editor.

About the author

Ilja Krasnjanski is an independent security researcher publishing as KrasForge. His work on UNK_DeadDrop began with three phishing messages he received in June and July 2026. From there he traced the associated artifacts through static analysis, repository history and configuration records, and he built the companion YARA rules and unk-scanner so that other analysts could do the same.

GitHub · ORCID 0009-0007-1039-5930 · Mastodon · Bluesky · Research site