POLINRIDER IS A/B TESTING ITS WAY PAST YOUR DETECTIONS

Summary from the TLDR InfoSec newsletter

DPRK's PolinRider malware spread through GitHub organizations by force-pushing rewritten commits from infected developers' machines, planting VS Code folderOpen tasks that run an obfuscated JavaScript payload disguised as fa-solid-400/500/900.woff2 and, since September 28, fa-solid-300.llf. OpenSourceMalware traced 853 force-pushes across three Binary-Mindz repos and found variants with different paths, obfuscators, and C2-reported build markers running in parallel, which it reads as deliberate A/B testing, while copied author dates and reused commit messages quietly reverted three cleanup attempts. Defenders should flag fake fonts by file content rather than name, scan every branch through bare clones, audit force-push activity logs, and enforce force-push blocking and signed commits on all branches.