Federal News
Malware Targets Developers with Auto-Executing Attacks
March 24, 2026
The newly discovered StoatWaffle malware represents a significant evolution in cyber threats targeting software developers by auto-executing malicious code through Visual Studio Code's trusted project feature. Linked to the North Korea-associated WaterPlum group, this malware exploits blockchain-themed repositories to infiltrate developer environments, increasing risks to software supply chains and developer workflows. This development highlights the growing need for enhanced cybersecurity measures within government and contractor software development processes to protect against supply chain compromises.
- Procurement professionals should prioritize acquiring cybersecurity solutions that detect and mitigate developer-targeted malware, especially those leveraging trusted development tools.
- Contractors involved in software development must evaluate their security protocols around code repositories and development environments to prevent infiltration.
- Agencies may consider updating cybersecurity requirements in contracts to address emerging threats targeting software supply chains and developer tools.
- This indicates a rising demand for advanced threat intelligence and secure software development lifecycle (SDLC) services in government procurement.
If the victim browser was Chromium family, it steals browser extension data besides stored credentials
— NTT researchers
Sources
- New ‘StoatWaffle’ malware auto‑executes attacks on developers | InfoWorld · InfoWorld · Mar 24