NorthKorean Hackers Abuse VS Code Auto‑Run Tasks to Deploy StoatWaffle Malware

Security researchers have confirmed a new campaign in which North Korean‑affiliated threat actors are exploiting the Auto‑Run Tasks feature in Microsoft Visual Studio Code (VS Code) to silently execute malicious commands and deploy a previously undocumented malware family known as StoatWaffle. The campaign, which began at least in early October 2024, leverages trusted developer tooling to bypass traditional endpoint detections, making it especially dangerous for organizations that rely on VS Code for daily development.

How VS Code Auto‑Run Tasks Work

VS Code allows developers to define tasks in a tasks.json configuration file. These tasks can be triggered manually, via keyboard shortcuts, or automatically when certain file events occur. In its default configuration, an auto‑run task is only executed when a developer explicitly starts it. However, attackers can modify the configuration to bind a task to a file‑watch event — such as the creation of a new .js or .py file — causing VS Code to run an arbitrary command each time that event fires.

The malicious actors abuse this mechanism by injecting a task that points to a PowerShell or Bash script stored in a seemingly innocuous location (e.g., a hidden .vscode folder). Because the task runs under the same user context as the developer, it can read source code, write files, and invoke system utilities without raising alarms.

The StoatWaffle Malware Payload

StoatWaffle is a multi‑stage dropper that first establishes persistence by creating a scheduled task or a registry Run key, then contacts a command‑and‑control (C2) server over HTTP/HTTPS to retrieve additional modules. Its primary capabilities include:

• Credential harvesting: Extracting VPN credentials, SSH keys, and stored passwords from development environments.
• File exfiltration: Encrypting and sending source code repositories to remote servers.
• Lateral movement: Using stolen credentials to pivot to other machines on the network.
• Payload delivery: Downloading a secondary backdoor that enables remote code execution.

Each stage is obfuscated with base64 encoding and Windows API calls that mimic legitimate development processes, making static analysis difficult.

Attribution to North Korean Threat Actors

Threat intelligence teams have linked the campaign to a group commonly referred to as APT43 or Vicuna, which is known for state‑sponsored espionage and financially motivated attacks originating from the Korean peninsula. The malware’s code signatures, C2 infrastructure, and use of Korean‑language strings in error messages align with previous activity attributed to this group.

What makes this campaign particularly concerning for modern enterprises is the blend of advanced persistence techniques with a focus on software development environments. Developers often work on isolated machines, but once compromised, those machines can become vectors for broader network compromise, especially if they have access to production repositories or privileged build servers.

Practical Defense Checklist

Below is a concise, actionable checklist that IT administrators and security leaders can implement immediately to reduce the risk of similar attacks.

• Audit VS Code configurations: Search all development workstations for tasks.json files that reference auto‑run triggers on file creation or modification.
• Enforce least‑privilege execution: Run all tasks under a restricted user account that lacks administrative rights on the host.
• Apply file‑system hardening: Set restrictive ACLs on the .vscode folder so that only trusted users can modify task definitions.
• Deploy endpoint detection and response (EDR): Enable behavior‑based monitoring that flags PowerShell or Bash scripts invoked from VS Code tasks.
• Network segmentation: Isolate developer workstations from critical servers and enforce strict outbound firewall rules for HTTP/HTTPS traffic.
• Regular code‑review of configuration files: Incorporate a code‑review step for any changes to tasks.json or related configuration files.
• Patch and update VS Code: Keep the editor and its extensions up to date to benefit from security improvements that Microsoft regularly releases.
• Conduct threat‑intel briefings: Share indicators of compromise (IOCs) such as known C2 domains and file hash values with the security operations center (SOC).

Implementing these steps not only disrupts the current StoatWaffle campaign but also strengthens the overall security posture of any organization that relies heavily on developer tools.

Conclusion

The convergence of sophisticated nation‑state threat actors with widely used development platforms underscores the need for proactive, professional IT management. By treating configuration files as high‑value assets, enforcing strict execution policies, and integrating advanced security monitoring, businesses can stay ahead of attackers who seek to abuse trusted toolchains. Investing in robust security practices not only protects intellectual property but also preserves client trust and regulatory compliance in an increasingly hostile cyber landscape.