2026-04-08 · 2026-Q2
UNC1069 Contagious Interview Cross-Ecosystem Package Campaign
Outside the model: Adjacent ecosystem Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- No, architectural
- Vendor response:
- Unknown
- In the wild:
- Yes
Target
npm, PyPI, Go, Rust, Packagist registries (developer tooling impersonation)
Impact
1,700+ malicious packages identified since January 2025 fueling espionage and financial theft; SEAL blocked 164 UNC1069 domains impersonating Teams and Zoom between Feb 6 and Apr 7, 2026
Root Cause
DPRK-linked UNC1069 (overlaps BlueNoroff, Sapphire Sleet, Stardust Chollima) publishing malware-loader packages disguised as dev tooling; delivery via fake Zoom/Teams ClickFix lures after LinkedIn/Telegram/Slack social engineering