Detection Engineer: 2026-09-28

1. PolinRider is A/B Testing its Way Past Your Detections

   OpenSourceMalware, 2026-09-26. Read, 24 min.

   OpenSourceMalware reports that PolinRider, which it says DPRK has been using to infect developers through a project's .vscode/tasks.json and a disguised .woff2 font file, has over the last couple of weeks been force-pushing new versions into already-compromised repositories in changes clearly designed to make it harder to detect. It describes the changes as evidence of experimentation, with the operators running A/B tests to see which variants are most effective.

   Why it matters for this role: Rules keyed to the fa-solid-400.woff2 filename miss PolinRider's newer variants, which is why OpenSourceMalware points detection at bursts of force-pushes to every branch from your own team's accounts.

Detection Engineer