Confirmed Void Dokkaebi infection on macOS — how do I figure…

Found TronGrid C2 code in three of my repos recently. Matches Void Dokkaebi style pretty cleanly. Running on macOS, not Windows, which is where my questions start.

The Trend Micro report describes temp_auto_push.bat for commit tampering — Windows only. I haven't found it on my machine. Is there a known macOS equivalent for this campaign? Or does the commit spoofing work differently on Mac?

Second question and the one I'm more stuck on: every single infected commit happened during a VS Code Copilot agent session. The agent was doing legitimate multi-file edits across my workspace each time. So I'm wondering if:

a) the agent got prompt-injected via something in the workspace and wrote the malicious code itself, or b) the commit tampering happened at the OS level independently and the agent sessions are just coincidence

If it's (a), I'd expect to find traces somewhere in VS Code's logs or Copilot telemetry. Does VS Code log what the agent actually wrote during a session anywhere? On macOS I've been looking in ~/Library/Application Support/Code/logs/ but not finding anything obviously useful.

If it's (b), what forensic artifacts would tell me a git amend + force push happened without me doing it?

Any pointers appreciated — still piecing this together before I write it up.

Impact

The malware can lead to unauthorized code injection into repositories, potentially compromising software supply chains and developer environments. The macOS infection vector and mechanisms remain partially unclear, complicating detection and response. There is no evidence of widespread exploitation or confirmed involvement of VS Code Copilot agent beyond user suspicion. The impact is medium severity due to potential codebase compromise and difficulty in attribution.

Defensive guidance

Since no official fixes or mitigations are documented, defenders should monitor for unusual git commit amendments and force pushes, especially those not initiated by authorized users. Investigate VS Code logs for anomalous agent activity, although current logs may not capture detailed Copilot agent writes. Maintain vigilance on repository integrity and consider restricting automated agent permissions until more is known.

Summary

Void Dokkaebi is a malware campaign that spreads via code repositories using social engineering lures such as fake job interviews. It has been confirmed to infect macOS, although prior technical details focused on Windows, including a batch script for commit tampering. A user report describes suspicious commits coinciding with VS Code Copilot agent sessions, raising questions about whether the agent was compromised or if tampering occurred at the OS level. The user seeks forensic guidance on detecting unauthorized git amend and force push operations and on locating VS Code Copilot logs on macOS. No official vendor advisories or patches are referenced.

Confirmed Void Dokkaebi infection on macOS — how do I figure out if VS Code Copilot agent was involved in the delivery?

Discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

AI analysisMachine-generated, updated 6 Jun 2026, 20:18 UTC

Technical details

References

Community reviews

Related threats