DeceptiveDevelopment hackers steal developer credentials to poison GitHub repositories and software packages
- Severity
- High
- Sources
- 1
What happened
ESET's APT Activity Report (April to September 2026) says DeceptiveDevelopment moved from fake-recruiter lures to supply-chain compromise via stolen Git credentials, SSH keys and tokens, with commit history rewritten to hide changes. Payloads include OmniStealer (Python infostealer) and DEVPOPPER (Node.js RAT persisting in VS Code, Cursor and Discord). The NullReceiver loader reads the C2 IP from an Ethereum transaction recipient address, and ESET says this is the first such use in a GitHub-hosted project. Staging used Gitea, JSONBin.io, JSONHosting and Pinata/IPFS. No CVEs are given. Defenders should rotate Git, SSH and publishing keys after suspected infection, review commits for rewritten history, and flag unexpected blockchain traffic from build systems.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed: this one is for your information.
General advice for this kind of story
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors