Loading story…
Jamf Threat Labs identified 14 unsigned, trojanized macOS DMG and PKG installers impersonating legitimate applications in the DPRK-attributed Contagious Interview campaign. The installers execute a hidden Intel-only .macos payload or abuse a malicious PKG preinstall chain, contact 162.0.239[.]85 for staged scripts, and deploy the OtterCookie malware family. Because the samples are unsigned and unnotarized, macOS Gatekeeper should block them unless a user removes the quarantine attribute.
OtterCookie provides Socket.IO-based remote access and can steal browser and cryptocurrency-wallet credentials, search memory for sensitive files, and capture clipboard contents. The activity extends the campaign beyond its prior developer-focused lures—including malicious VS Code tasks and Git hooks—while retaining related staging behavior; the updated chain uses ~/.task and JWT-protected requests to retrieve later-stage payloads.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The lazarusholic Bluesky account linked to Jamf's analysis, characterizing the activity as trojanized macOS installers associated with Contagious Interview and OtterCookie.
Analysis of the GAPIUpdate.dmg macOS disk image detailed its execution chain and linked it to Odyssey Stealer command-and-control infrastructure. The analysis reported cryptocurrency-wallet address replacement behavior and identified 27 related DMG files hosted on GitHub.
Technical reporting disclosed the staged macOS execution chain used by the trojanized installers, including hidden .macos launchers, the ~/.task Node.js payload directory, tokenized retrieval endpoints, and OtterCookie deployment. It also identified staging and C2 infrastructure, associated domains, ports, payload hashes, and OtterCookie's browser- and cryptocurrency-credential theft, clipboard collection, and in-memory file scanning capabilities.
Jamf Threat Labs identified 14 unsigned DMG and PKG installers impersonating legitimate macOS applications in the DPRK-attributed Contagious Interview campaign. The installers use hidden payloads or malicious PKG scripts to retrieve staged components and ultimately deploy OtterCookie malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcecyberaccord.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcebsky.app
Open sourcejamf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported a **Contagious Interview** intrusion tied to a DPRK-aligned threat cluster after suspicious activity targeted Elastic’s community Slack workspace. Using a fake recruiter persona named **Maxwell**, the operator posted a fraudulent job opportunity and coding challenge that directed victims to trojanized **Next.js** e-commerce repositories. The malicious code hid payload components inside SVG image files using steganography, embedding Base64 fragments in flag images that were reassembled by `serverValidation.js` and executed with `eval()` when the local development server started. The campaign matches the broader **Contagious Interview** tradecraft tracked in **MITRE ATT&CK** as **G1052**, which relies on fake hiring outreach, code-repository lures, and social engineering to infect developers across **Windows, macOS, and Linux**. Elastic said the infection chain deployed a browser credential and crypto-wallet stealer, a file stealer, a persistent **Socket.IO** RAT, and a clipboard stealer capable of fetching Windows PE payloads, while code similarities to **OTTERCOOKIE** and infrastructure overlaps previously documented by JFrog reinforced the attribution. MITRE also associates the cluster with malware such as **BeaverTail** and **InvisibleFerret**, along with credential theft, financial theft, persistence through platform-specific startup mechanisms, and exfiltration over C2 and cloud or messaging services.
Jul 24, 2026
North Korea-linked operators tracked as **HexagonalRodent**, **Contagious Interview**, and overlaps of **Lazarus/Famous Chollima** used fake recruiter outreach on LinkedIn and sham company infrastructure to lure software and Web3 developers into opening malicious coding assessments. Researchers said the campaign delivered malware including **BeaverTail**, **InvisibleFerret**, and **OtterCookie** through backdoored GitHub repositories, rogue npm content, malicious VS Code `tasks.json` execution, and weaponized Git hooks such as `pre-commit` and `post-checkout`. The malware targeted Windows, macOS, and Linux systems, stealing browser credentials, keychains, wallet data, seed phrases, and developer secrets while maintaining persistence and remote access.
Aug 14, 2026
North Korea-linked threat actors have significantly expanded the 'Contagious Interview' campaign, targeting software developers in the crypto and Web3 sectors by uploading 197 new malicious npm packages designed to distribute an updated version of the OtterCookie infostealer. These actors, posing as recruiters on platforms like LinkedIn, use sophisticated social engineering tactics such as fake job interviews and trojanized demo projects to lure victims on Windows, Linux, and macOS. The campaign leverages a full delivery infrastructure, including a threat actor–controlled GitHub account and Vercel-hosted staging sites, to store and deliver malware, with command and control servers used for data theft and remote tasking. The campaign's payloads include the BeaverTail and OtterCookie infostealers and the InvisibleFerret RAT, and the malicious npm packages have been downloaded over 31,000 times, highlighting the scale and persistence of the operation. Technical analysis reveals that the attackers have built a robust malware delivery system, using their GitHub account to host repositories and fetch the latest payloads from Vercel, while maintaining separate C2 infrastructure for exfiltration and tasking. At least five npm packages, including 'tailwind-magic' and its variants, have been directly linked to this campaign. The operation demonstrates the increasing sophistication of North Korean supply chain attacks, with a focus on compromising developers in high-value sectors through open-source ecosystems. Security researchers continue to monitor the evolving tactics and infrastructure associated with this campaign, warning organizations and developers to exercise heightened vigilance when interacting with unsolicited job offers and npm packages.
Jun 29, 2026