Loading story…
Researchers reported a newly observed malware campaign that used a fake job interview coding challenge to infect developers with platform-specific stagers on Windows, macOS, and Unix-like systems, a lure pattern they associated with DPRK-linked activity. The infection chain created a hidden fake Visual Studio Code directory, downloaded bootstrap scripts, gathered host information, and then fetched a final payload named ghost.js on Unix/macOS or ghost.npl on Windows; a related social post highlighted the campaign’s phishing and VS Code themes.
The malware collected system details including hostname, platform, IP address, and MAC address, then registered victims with a command-and-control server using a Base64-decoded endpoint and key. Researchers said the payload used familiar obfuscation techniques and had no VirusTotal detections at the time of analysis, and they published infrastructure and hashes tied to the operation, including C2 141.94.148.39:1224 and a related Vercel-hosted domain that was reportedly taken down; they also said weaknesses in the C2 design allowed repeated spoofed victim registrations that could disrupt the server.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
A Bluesky account, lazarusholic, shared a link to Bitso's "North Korea’s Crypt: Hunting Ghosts" article with the hashtags #Phishing and #VSCode. The post did not add substantive new incident details beyond amplifying the report.
Bitso published the article "North Korea’s Crypt: Hunting Ghosts," detailing the fake interview lure, malware chain, infrastructure, and file hashes tied to the campaign. At the time of analysis, the researchers said the final payloads had zero VirusTotal detections.
The researchers said they identified a flaw that let them repeatedly spoof victim registration requests to the command-and-control server. They claimed they could make the server believe a victim named "QuetzalTeam" had been registered multiple times per second, disrupting the infrastructure.
The malicious domain ip-checking-psi[.]vercel[.]app, used in the fake coding challenge, was reportedly taken down quickly. This removed one piece of infrastructure tied to the campaign.
The authors associated the fake interview lure and malware tradecraft with DPRK-linked malware activity based on familiar patterns and obfuscation techniques they said they had seen repeatedly over the last three years. They also documented the malware's host-registration behavior and C2 infrastructure at 141.94.148.39:1224.
Researchers described a newly observed malware infection delivered through a fake job interview coding challenge sent to a Quetzal Team developer named Alex. The lure used a Vercel-hosted domain and deployed platform-specific stagers that ultimately fetched the final payload ghost.js or ghost.npl.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported a **Contagious Interview** intrusion tied to a DPRK-aligned threat cluster after suspicious activity targeted Elastic’s community Slack workspace. Using a fake recruiter persona named **Maxwell**, the operator posted a fraudulent job opportunity and coding challenge that directed victims to trojanized **Next.js** e-commerce repositories. The malicious code hid payload components inside SVG image files using steganography, embedding Base64 fragments in flag images that were reassembled by `serverValidation.js` and executed with `eval()` when the local development server started. The campaign matches the broader **Contagious Interview** tradecraft tracked in **MITRE ATT&CK** as **G1052**, which relies on fake hiring outreach, code-repository lures, and social engineering to infect developers across **Windows, macOS, and Linux**. Elastic said the infection chain deployed a browser credential and crypto-wallet stealer, a file stealer, a persistent **Socket.IO** RAT, and a clipboard stealer capable of fetching Windows PE payloads, while code similarities to **OTTERCOOKIE** and infrastructure overlaps previously documented by JFrog reinforced the attribution. MITRE also associates the cluster with malware such as **BeaverTail** and **InvisibleFerret**, along with credential theft, financial theft, persistence through platform-specific startup mechanisms, and exfiltration over C2 and cloud or messaging services.
Jul 24, 2026
North Korea-linked threat actors tied to the long-running **Contagious Interview** operation have been observed using **malicious Microsoft Visual Studio Code (VS Code) projects** as part of fake job-assessment lures, instructing targets to clone repositories from GitHub/GitLab/Bitbucket and open them in VS Code. The technique abuses VS Code `tasks.json` configuration—specifically `"runOn": "folderOpen"`—to trigger execution when a folder is opened, pulling staged payloads from attacker-controlled infrastructure (including Vercel-hosted domains) and ultimately deploying backdoors such as **BeaverTail** and **InvisibleFerret** that enable remote code execution and follow-on control. Recent iterations reportedly add multi-stage droppers embedded in task configuration content and disguised as benign files (e.g., spell-check dictionaries) to improve resilience if network retrieval fails, and include command-and-control behavior that can execute attacker-supplied JavaScript from a remote server (e.g., `ip-regions-check.vercel[.]app`). Separate reporting on North Korean APT trends indicates continued reliance on **fraudulent IT employment schemes** and recruitment-platform abuse to gain access to Western organizations, including long-term social engineering and persistent remote access via legitimate tools (e.g., *AnyDesk*, *Google Remote Desktop*) and VPN/location obfuscation. This broader pattern aligns with the same overarching tradecraft used in developer-targeted “interview” lures: leveraging hiring workflows and developer tooling to establish initial access and persistence while reducing suspicion, particularly in environments with remote-work infrastructure and developer workstations.
Jul 4, 2026
DPRK-linked operators expanded the **Contagious Interview** social-engineering campaign by posing as recruiters and sending developers malicious GitHub or GitLab repositories that execute malware when opened in **Visual Studio Code**. Researchers said the attack does not rely on a software vulnerability; instead, it abuses trusted developer workflows, including `.vscode/tasks.json`, `package.json`, and `Next.js` configuration files, to trigger background execution after a victim opens a project and trusts the author. In observed cases, `npm start` or a VS Code task launched a staged JavaScript payload, including code hidden in files such as `scripts/jquery.min.js`, which then contacted attacker infrastructure hosted on **Vercel** and related domains.
Aug 18, 2026