Loading
Get Access
Subscribe
Threat actor Team 8, associated with North Korean state interests, has been observed distributing the StoatWaffle malware through malicious Microsoft Visual Studio Code projects. The attack vector relies on the 'tasks.json' configuration file, which automatically executes predefined commands when a project folder is opened in the IDE. This technique allows attackers to achieve code execution on a victim's machine without requiring additional user interaction beyond opening the project. The campaign has been active since late 2025.
This campaign represents a sophisticated supply chain and social engineering threat targeting the software development ecosystem. By weaponizing legitimate IDE features, attackers can bypass traditional security controls that focus on executable files rather than configuration-based triggers. The use of StoatWaffle malware suggests an intent to establish persistent access for espionage or further lateral movement within corporate networks. Organizations relying on open-source or third-party code repositories are at elevated risk of compromise.
Advisory purposes only · QPulse Security Intelligence Platform · 2026 · Brief #00421
