Loading story…
Microsoft and Enki White Hat reported ongoing “Contagious Interview” activity in which threat actors impersonate recruiters and run realistic developer interview workflows to trick targets into executing malicious code. The campaign targets software developers (including at enterprise solution providers and media/communications firms) and has been active since at least December 2022, using lures such as coding assignments and repositories hosted on common platforms (e.g., GitHub, GitLab, Bitbucket). Recent intrusions show an adaptation to Visual Studio Code workflows: victims are prompted to trust the repository, and once trust is granted, VS Code can automatically execute attacker-supplied task configurations, turning a routine “open the project” step into an initial execution vector.
Technical analysis describes GitHub-hosted repositories containing a malicious .vscode/tasks.json where runOptions.runOn is set to folderOpen, causing hidden, whitespace-obfuscated commands to run when the folder is opened in VS Code. The tasks execute OS-specific downloaders that fetch and run follow-on scripts from C2 infrastructure; on Linux/macOS, a script is downloaded to $HOME/Documents/tokenlinux.npl, renamed to tokenlinux.sh, and executed, while Windows attempts to download to %USERPROFILE%/parse and rename to token.cmd (the Windows payload was unavailable during analysis due to an “Access permanently suspended.” response). The Linux/macOS chain includes a downloader assessed to be LLM-generated (noted for unusually detailed comments and emoji usage), which stages a local Node.js runtime, pulls additional files such as parser.js and package.json, and executes the obfuscated JavaScript downloader; observed payload sets include BeaverTail and InvisibleFerret, with OtterCookie also deployed in some paths depending on environment or attack stage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Enki White Hat published analysis focused on the Contagious Interview campaign's abuse of Visual Studio Code distributed through GitHub. The post documented the same broader operation in Korean and English-language versions.
Microsoft Defender Experts published research describing the long-running Contagious Interview campaign and its tactics, malware, and targeting. The report also noted increasing use of modular cross-platform malware, obfuscation, and abuse of developer tooling.
Microsoft reported that the operation used multiple malware families, including the JavaScript beaconing agent OtterCookie as well as Invisible Ferret and FlexibleFerret. The tooling provided persistence, remote access, and theft of developer-held secrets such as API tokens, cloud credentials, signing keys, wallets, and source code.
During the campaign, threat actors lured victims into running malicious NPM packages or Visual Studio Code tasks from GitHub, GitLab, and Bitbucket repositories. The activity abused trust in technical interview exercises to gain execution on developer systems.
Microsoft said the Contagious Interview social-engineering operation has been active since at least December 2022. The campaign impersonates recruiters and targets software developers through fake job interview workflows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
enki.co.kr
Open sourceenki.co.kr
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked threat actors tied to the long-running **Contagious Interview** operation have been observed using **malicious Microsoft Visual Studio Code (VS Code) projects** as part of fake job-assessment lures, instructing targets to clone repositories from GitHub/GitLab/Bitbucket and open them in VS Code. The technique abuses VS Code `tasks.json` configuration—specifically `"runOn": "folderOpen"`—to trigger execution when a folder is opened, pulling staged payloads from attacker-controlled infrastructure (including Vercel-hosted domains) and ultimately deploying backdoors such as **BeaverTail** and **InvisibleFerret** that enable remote code execution and follow-on control. Recent iterations reportedly add multi-stage droppers embedded in task configuration content and disguised as benign files (e.g., spell-check dictionaries) to improve resilience if network retrieval fails, and include command-and-control behavior that can execute attacker-supplied JavaScript from a remote server (e.g., `ip-regions-check.vercel[.]app`). Separate reporting on North Korean APT trends indicates continued reliance on **fraudulent IT employment schemes** and recruitment-platform abuse to gain access to Western organizations, including long-term social engineering and persistent remote access via legitimate tools (e.g., *AnyDesk*, *Google Remote Desktop*) and VPN/location obfuscation. This broader pattern aligns with the same overarching tradecraft used in developer-targeted “interview” lures: leveraging hiring workflows and developer tooling to establish initial access and persistence while reducing suspicion, particularly in environments with remote-work infrastructure and developer workstations.
Jul 4, 2026
Elastic Security Labs reported a **Contagious Interview** intrusion tied to a DPRK-aligned threat cluster after suspicious activity targeted Elastic’s community Slack workspace. Using a fake recruiter persona named **Maxwell**, the operator posted a fraudulent job opportunity and coding challenge that directed victims to trojanized **Next.js** e-commerce repositories. The malicious code hid payload components inside SVG image files using steganography, embedding Base64 fragments in flag images that were reassembled by `serverValidation.js` and executed with `eval()` when the local development server started. The campaign matches the broader **Contagious Interview** tradecraft tracked in **MITRE ATT&CK** as **G1052**, which relies on fake hiring outreach, code-repository lures, and social engineering to infect developers across **Windows, macOS, and Linux**. Elastic said the infection chain deployed a browser credential and crypto-wallet stealer, a file stealer, a persistent **Socket.IO** RAT, and a clipboard stealer capable of fetching Windows PE payloads, while code similarities to **OTTERCOOKIE** and infrastructure overlaps previously documented by JFrog reinforced the attribution. MITRE also associates the cluster with malware such as **BeaverTail** and **InvisibleFerret**, along with credential theft, financial theft, persistence through platform-specific startup mechanisms, and exfiltration over C2 and cloud or messaging services.
Jul 20, 2026
Multiple reports describe **social-engineering and supply-chain style attacks** that trick developers or AI-agent users into executing attacker-controlled instructions. North Korean operators have been linked to the **“Contagious Interview”** campaign, in which fake recruiter personas lure software developers into running “technical interview” projects that deploy malware such as **BeaverTail** and **OtterCookie** for credential theft and remote access; GitLab reported banning **131 related accounts** in 2025, with many repos using **hidden loaders** that fetched payloads from third-party services (e.g., *Vercel*) rather than hosting malware directly. Separately, OpenGuardrails reported a campaign on *ClawHub* (an OpenClaw AI agent “skills” repository) where attackers posted **malicious troubleshooting comments** containing Base64-encoded commands that download a loader from `91[.]92[.]242[.]30`, remove macOS quarantine attributes, and install **Atomic macOS (AMOS) infostealer**—a delivery method that can evade package-focused scanning because the payload is in comments, not the skill artifact. Research and incident writeups also highlight how **indirect prompt injection** and **malicious open-source packages** can compromise developer environments. NSFOCUS summarized a GitHub **MCP cross-repository data leak** scenario where attacker-injected instructions in public Issues could cause locally running AI agents to exfiltrate private repo data when agents act with broad GitHub permissions, and cited a similar hidden-command issue affecting an AI browser’s page summarization workflow. JFrog reported malicious npm packages (e.g., `eslint-verify-plugin`, `duer-js`) delivering multi-stage payloads including a **macOS RAT** (Mythic/Apfell) and a Windows infostealer, reinforcing ongoing risk from poisoned dependencies. In contrast, a DFIR case study on **CVE-2023-46604** exploitation of Apache ActiveMQ leading to **LockBit**-style ransomware, and a Medium post on recon/content-discovery techniques, are separate topics and not part of the AI-agent/developer social-engineering thread.
Jun 29, 2026