GCVE-110-OSM-2023-41

PolinRider backdoor injection (rmcej%otb% variant) - obfuscated JavaScript payload appended to public/fonts/fa-solid-400.woff2. Shuffle-cipher deobfuscation with blockchain dead-drop C2 (TRON/Aptos/BSC). Part of confirmed DPRK Contagious Interview campaign targeting ~1,951 known victim repos. Malicious payload found in: public/fonts/fa-solid-400.woff2 (fake-font vector) Signature marker: rmcej%otb% (original PolinRider variant) hidden in .woff2 font blob Shuffle seed: 2857687 | Decoder function: _$_1e42 | Secondary seed: 2667686 Attack vector: Obfuscated JavaScript payload smuggled inside a .woff2 font file and executed via Node.js at load time. Same PolinRider shuffle-cipher architecture as the config-file variant, delivered through a different vector to evade static config-file scanning. Behavior: Fetches encrypted second-stage payloads from blockchain dead-drop C2 infrastructure (TRON/Aptos/BSC) and executes via eval(). Blockchain-based dead-drop makes C2 takedown virtually impossible.