How a Malicious VSIX Uses the Signed Editor Runtime
How a fake Google Update Support extension installs its components and runs the editor's own Electron binary as a Node interpreter.
Series
UNK_DeadDrop: Developer-Targeted Recruitment Malware
Six parts from an artifact-led investigation of a fake-recruitment campaign that targeted software developers: a malicious VS Code extension, parse-only deobfuscation, a GitLab dead drop, target harvesting from commit metadata, detection engineering, and the boundary between a public framework and the collection tools. All fourteen parts and both papers are on the research site: https://krasforge.github.io/UNK_DeadDrop/
Posts in this series
Parsing Without Executing: JavaScript Deobfuscation with Acorn
Rebuilding an AES key from sixteen obfuscated fragments with Acorn, proven by authenticated decryption without running the extension.
Following the GitLab Dead Drop: Configuration Changes and C2 History
How a GitLab-hosted configuration file let the UNK_DeadDrop operators change servers without new payloads, and what its revision history reveals.
From Commit Metadata to a Developer Target List
Reconstructing the harvester, sender configuration and aggregate counts behind two SQLite targeting pools. Original URL
Building and Testing Detections for UNK_DeadDrop
Thirty-three YARA rules replayed against retained artifacts, followed by a separate noise review and static scanner evaluation.
Where Overlord Ends and the Collection Toolchain Begins
Overlord build metadata, browser-store selectors, wallet-upload markers and capture components in the Linux agent.
