New DPRK Interview Campaign Uses Fake Fonts to Deliver Malware

Cybersecurity: Contagious Interview Campaign

A new variant of the "Contagious Interview" campaign has emerged, leveraging Microsoft Visual Studio Code task files to deploy advanced malware targeting software developers. Over the past 100 days, this campaign has significantly escalated, with 17 malicious GitHub repositories discovered across 11 distinct attack variants.

North Korean threat actors, associated with the Lazarus Group, continue to target software engineers through sophisticated supply chain attacks disguised as legitimate recruitment processes. The latest "Fake Font" campaign exploits VS Code's task automation feature to execute JavaScript malware concealed within files posing as web fonts, ultimately deploying the InvisibleFerret Python backdoor for cryptocurrency theft and persistent system access.

The attack begins with social engineering on LinkedIn, where fake recruiters impersonating cryptocurrency or fintech companies contact targets with enticing job opportunities. The repository appears legitimate, containing a web application project with a React frontend, Node.js backend, and complete documentation.

The malicious payload is located within the .vscode/tasks.json file, which VS Code uses for workflow automation. Configured with "runOn": "folderOpen" and "reveal": "never" parameters, the task executes silently when developers open the project and click "Trust Workspace." The command node public/fonts/fa-brands-regular.woff2 is executed, launching heavily obfuscated JavaScript malware.

Initial analysis of the malicious "font" file revealed JavaScript source code using Base91 encoding, an advanced binary-to-ASCII encoding scheme that evades detection by tools optimized for common formats like Base64. The first-stage loader, known as BeaverTail, creates hidden directories in ~/.npm/, installs npm packages including axios and request, and contacts a command-and-control server at eth-mainnet-alchemy.com, a typosquat domain mimicking the legitimate Alchemy Ethereum API service.

The final payload is InvisibleFerret, a Python-based backdoor with extensive capabilities including theft of over 13 cryptocurrency wallet extensions (e.g., MetaMask, Phantom, Coinbase Wallet), browser credential harvesting, keylogging, and clipboard hijacking. The malware establishes persistence across Windows, macOS, and Linux systems, maintaining remote access via WebSocket connections.

The complete infection chain executes in approximately 40 seconds, often before victims finish reading the coding assessment instructions. Many compromised developers remain unaware of the attack until forensic analysis reveals the vector.

OpenSourceMalware successfully analyzed 14 of the 17 identified repositories, discovering 11 unique payload variants, highlighting the persistent and evolving threat facing the software development community. The campaign is tracked under the #fake-font tag with indicators of compromise available at opensourcemalware.com.

Based on reporting by GBHackers.