Ransom-ISAC analyzed a suspected DPRK-affiliated campaign that used a weaponized private GitHub repository to compromise cryptocurrency and developer environments. The attack chain combined DEV#POPPER.js, a cross-platform JavaScript payload, with OmniStealer, a Python stealer targeting wallets, private keys, browser credentials, development secrets, and source code. A key technique was Cross-Chain TxDataHiding, where malware queried TRON or Aptos transaction data to recover a BSC transaction hash and then pulled encrypted payload data from Binance Smart Chain transaction input. This multi-chain design increases takedown resistance and complicates detection because command data is distributed across immutable blockchain infrastructure and backup paths.