Loading story…
Elastic Security Labs reported a Contagious Interview intrusion tied to a DPRK-aligned threat cluster after suspicious activity targeted Elastic’s community Slack workspace. Using a fake recruiter persona named Maxwell, the operator posted a fraudulent job opportunity and coding challenge that directed victims to trojanized Next.js e-commerce repositories. The malicious code hid payload components inside SVG image files using steganography, embedding Base64 fragments in flag images that were reassembled by serverValidation.js and executed with eval() when the local development server started.
The campaign matches the broader Contagious Interview tradecraft tracked in MITRE ATT&CK as G1052, which relies on fake hiring outreach, code-repository lures, and social engineering to infect developers across Windows, macOS, and Linux. Elastic said the infection chain deployed a browser credential and crypto-wallet stealer, a file stealer, a persistent Socket.IO RAT, and a clipboard stealer capable of fetching Windows PE payloads, while code similarities to OTTERCOOKIE and infrastructure overlaps previously documented by JFrog reinforced the attribution. MITRE also associates the cluster with malware such as BeaverTail and InvisibleFerret, along with credential theft, financial theft, persistence through platform-specific startup mechanisms, and exfiltration over C2 and cloud or messaging services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic reported that the malware payload was hidden in SVG files using steganography, then reassembled and executed from serverValidation.js when the development server started. The company attributed the activity to the DPRK-aligned Contagious Interview cluster based on code similarities to OTTERCOOKIE and infrastructure overlaps previously documented by JFrog Security.
Elastic Security Labs documented a new Contagious Interview campaign after suspicious activity targeted Elastic’s community Slack workspace. The operation used a fake recruiter persona named Maxwell to post a fraudulent job offer and coding challenge that lured victims to trojanized Next.js repositories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcemeetcyber.net
Open sourcecyberveille.ch
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked operators tracked as **HexagonalRodent**, **Contagious Interview**, and overlaps of **Lazarus/Famous Chollima** used fake recruiter outreach on LinkedIn and sham company infrastructure to lure software and Web3 developers into opening malicious coding assessments. Researchers said the campaign delivered malware including **BeaverTail**, **InvisibleFerret**, and **OtterCookie** through backdoored GitHub repositories, rogue npm content, malicious VS Code `tasks.json` execution, and weaponized Git hooks such as `pre-commit` and `post-checkout`. The malware targeted Windows, macOS, and Linux systems, stealing browser credentials, keychains, wallet data, seed phrases, and developer secrets while maintaining persistence and remote access.
Jul 17, 2026
North Korea-linked threat actors have significantly expanded the 'Contagious Interview' campaign, targeting software developers in the crypto and Web3 sectors by uploading 197 new malicious npm packages designed to distribute an updated version of the OtterCookie infostealer. These actors, posing as recruiters on platforms like LinkedIn, use sophisticated social engineering tactics such as fake job interviews and trojanized demo projects to lure victims on Windows, Linux, and macOS. The campaign leverages a full delivery infrastructure, including a threat actor–controlled GitHub account and Vercel-hosted staging sites, to store and deliver malware, with command and control servers used for data theft and remote tasking. The campaign's payloads include the BeaverTail and OtterCookie infostealers and the InvisibleFerret RAT, and the malicious npm packages have been downloaded over 31,000 times, highlighting the scale and persistence of the operation. Technical analysis reveals that the attackers have built a robust malware delivery system, using their GitHub account to host repositories and fetch the latest payloads from Vercel, while maintaining separate C2 infrastructure for exfiltration and tasking. At least five npm packages, including 'tailwind-magic' and its variants, have been directly linked to this campaign. The operation demonstrates the increasing sophistication of North Korean supply chain attacks, with a focus on compromising developers in high-value sectors through open-source ecosystems. Security researchers continue to monitor the evolving tactics and infrastructure associated with this campaign, warning organizations and developers to exercise heightened vigilance when interacting with unsolicited job offers and npm packages.
Jun 29, 2026
**Microsoft and Enki White Hat reported ongoing “Contagious Interview” activity** in which threat actors impersonate recruiters and run realistic developer interview workflows to trick targets into executing malicious code. The campaign targets software developers (including at enterprise solution providers and media/communications firms) and has been active since at least December 2022, using lures such as coding assignments and repositories hosted on common platforms (e.g., GitHub, GitLab, Bitbucket). Recent intrusions show an adaptation to *Visual Studio Code* workflows: victims are prompted to trust the repository, and once trust is granted, VS Code can automatically execute attacker-supplied task configurations, turning a routine “open the project” step into an initial execution vector. Technical analysis describes GitHub-hosted repositories containing a malicious `.vscode/tasks.json` where `runOptions.runOn` is set to `folderOpen`, causing hidden, whitespace-obfuscated commands to run when the folder is opened in VS Code. The tasks execute OS-specific downloaders that fetch and run follow-on scripts from C2 infrastructure; on Linux/macOS, a script is downloaded to `$HOME/Documents/tokenlinux.npl`, renamed to `tokenlinux.sh`, and executed, while Windows attempts to download to `%USERPROFILE%/parse` and rename to `token.cmd` (the Windows payload was unavailable during analysis due to an “Access permanently suspended.” response). The Linux/macOS chain includes a downloader assessed to be LLM-generated (noted for unusually detailed comments and emoji usage), which stages a local Node.js runtime, pulls additional files such as `parser.js` and `package.json`, and executes the obfuscated JavaScript downloader; observed payload sets include **BeaverTail** and **InvisibleFerret**, with **OtterCookie** also deployed in some paths depending on environment or attack stage.
Jun 29, 2026