Skip to content
UNK_DeadDrop

UNK_DeadDrop technical series

An artifact-led investigation of developer-targeted phishing and its supporting collection infrastructure.
Start with Part 1Read the technical paperRead the scanner paperOpen Source Detection Rules

The series starts with three recruitment messages received in June and July 2026. It follows the evidence through clipboard substitution, a malicious editor extension, credential and wallet collection, mutable infrastructure, targeting databases, administration software, and experimental detections.

The underlying case evidence ends on 24 July 2026. Public reporting was checked through 25 October 2026. Each article distinguishes static capability from observed execution and identifies where the retained artifacts stop.

Read the investigation

Section titled “Read the investigation”
  1. Anatomy of a Developer Lure: ClickFix Clipboard Manipulation
  2. How a Malicious VSIX Uses the Signed Editor Runtime
  3. Parsing Without Executing: JavaScript Deobfuscation with Acorn
  4. Inside the Collector: Browser Credentials and Wallet Files
  5. Beyond Screenshot Strings: Reconstructing Screen Capture
  6. Following the GitLab Dead Drop
  7. From Commit Metadata to a Developer Target List
  8. Inside rms-platform
  9. Tracing the ECHOES Archive
  10. From Three Phishing Emails to a Connected Investigation
  11. Building and Testing Detections for UNK_DeadDrop
  12. Where Overlord Ends and the Collection Toolchain Begins
  13. What 2.8 Million Files Revealed About unk-scanner
  14. When a Decoder Returns the Wrong Strings

Scope

Section titled “Scope”

The published material excludes raw contact databases, credentials, and a complete forensic sample set. Supporting PDFs are edited evidence reports derived from the restricted case material. The series does not claim successful compromise, financial loss, or real-world attribution where the artifacts do not establish those outcomes.

About the author

Section titled “About the author”

Ilja Krasnjanski is an independent security researcher publishing as KrasForge. He studies developer recruitment lures, malware and detection methods. More about the author.