TLDR Tech / InfoSec
PolinRider is A/B Testing its Way Past Your Detections
DPRK's PolinRider malware is actively evading detection by using A/B testing tactics, spreading through GitHub organizations via force-pushed rewritten commits from infected developer machines. It plants obfuscated JavaScript payloads disguised as font files (e.g., 'fa-solid-400/500/900.woff2' and 'fa-solid-300.llf' since September 28th) that run VS Code 'folderOpen' tasks. OpenSourceMalware identified 853 force-pushes across three Binary-Mindz repositories, noting parallel-running variants with different paths, obfuscators, and C2-reported build markers, indicating deliberate A/B testing. Defenders are advised to flag fake fonts by file content, scan all branches via bare clones, audit force-push activity logs, and enforce force-push blocking and signed commits on all branches.
Read the full story