TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

IDE Attack Prevention

6 posts · Jan 2021 – May 2026

What this trail covers

GitLab's Security Operations team has developed custom controls to detect and prevent malware campaigns that leverage IDE tasks for distribution, specifically addressing the 'Contagious Interview' threat campaign. This involves low-level detection mechanisms focusing on subprocess execution within IDEs like VS Code, aiming to protect GitLab workstations and customers from malicious code execution that can lead to infostealers, credential theft, and persistence establishment. The detection leverages custom scripts to decode malware from binary data in a fake font file, and abuses legitimate services like Vercel to host payloads. The team also identified and banned accounts used for these campaigns, and observed distinct subgroups of activity operating in parallel.

All GitLab trails
  1. How to detect and prevent Contagious Interview IDE attacksThis post details the development of custom detection and prevention controls for IDE task-based malware distribution, specifically targeting the 'Contagious Interview' campaign. It explains how the `node-pty.spawn()` library and its `spawn-helper` binary are used by IDEs like VS Code for background task execution. The core contribution is the creation of EDR telemetry-based detections that differentiate between legitimate foreground processes and suspicious background subprocesses spawned without user interaction, specifically by monitoring `spawn-helper` calls. It also outlines proactive hardening measures such as disabling VS Code tasks globally and educating users on the risks.
  2. GitLab Threat Intelligence Team reveals North Korean tradecraftThis post details the identification and analysis of North Korean nation-state threat actors using GitLab.com to distribute malware via fake technical interview projects. It describes the 'Contagious Interview' campaign, the malware infrastructure used (JavaScript codebases, Vercel hosting, custom domains), and specific execution patterns involving base64 encoded URLs, trigger functions, and custom error handlers that execute remote code. The post also highlights the use of VS Code tasks for malware execution and the observation of distinct, parallel operational teams.
  3. Use GitLab and MITRE ATT&CK Navigator to visualize adversary techniquesThis post details how to use GitLab and the MITRE ATT&CK Navigator to visualize adversary techniques. It provides an example project that deploys the ATT&CK Navigator web application pre-populated with custom annotated matrices, enabling users to visualize their coverage of techniques across the ATT&CK framework. The post explains the MITRE ATT&CK framework, how to fork the example project, and how the underlying components (gitlab-ci.yml, create-layers.py, build-navigator.sh) work together to build and host the static website using GitLab Pages. It also highlights additional features of the ATT&CK Navigator app for visualizing coverage.
  4. Why are developers so vulnerable to drive-by attacks?This post details a specific instance of a drive-by RCE attack against the GitLab Development Kit (GDK) by chaining vulnerabilities in Better Errors and webpack-dev-server. It explains how improper content type validation and lack of CSRF protection in Better Errors, combined with webpack-dev-server's permissive CORS configuration, allowed for arbitrary code execution. The post also provides a general explanation of drive-by attacks, CORS preflight requests, simple requests, and the importance of proper origin validation and CSRF protection.
  5. You asked, and our Red Team answeredThis post details the Red Team's approach to endpoint security and credential hunting, including the development and use of tools like gitrob and token hunter. It also describes their methodology for simulating insider threats and assumed breach scenarios, and how they use GitLab and Vectr for managing testing intelligence. The post highlights their collaborative approach with other security and application groups, and their strategies for building trust and breaking down the stigma associated with red teaming within the organization. It also touches on mimicking known TTPs from frameworks like MITRE ATT&CK and tailoring them to GitLab's environment.