North Korean Hackers Exploit Code Repositories in “Contagious Interview” Campaign
Recent findings have documented a campaign, identified as "Contagious Interview," involving North Korean threat actors exploiting developer tools and code-repository workflows. The campaign aims to steal credentials, cryptocurrency wallets, and establish…
Recent findings have documented a campaign, identified as "Contagious Interview," involving North Korean threat actors exploiting developer tools and code-repository workflows. The campaign aims to steal credentials, cryptocurrency wallets, and establish remote access without requiring victims to execute the received code.
In a notable case, a malicious Bitbucket repository was used as a technical assessment sent to a developer via LinkedIn. Over the past month, SEAL has been contacted by three victims who experienced significant financial losses due to this social-engineering tactic.
The campaign employs a dual-stack malware architecture comprising a Node.js component (BeaverTail) and a Python component (InvisibleFerret variant). This malware targets developers and engineers through code review requests or partnership invitations, often utilizing compromised or fabricated recruiter profiles.
The Node.js component activates immediately upon infection, capturing credentials, logging keystrokes, and accessing LevelDB browser and wallet data. It also creates a covert remote access tool (RAT) in the victim's ~/.npm directory. The Python layer, initiated via an obfuscated ".nlp" script, sets up a parallel surveillance system under ~/.n2 and ~/.n3 directories.
The primary Python module, way.py, functions as a RAT and wallet stealer, while another module, pow.py, focuses on mining and persistence on Windows systems. On Linux and macOS, pow.py is ineffective due to Windows-specific imports.
The initial access is achieved through code abuse rather than traditional exploits. The ctrading project incorporates malware through several vectors, including a VS Code Task Hijack and an application-logic hook.
URL / IP Path Port Stage / Function
The campaign aims to steal credentials, cryptocurrency wallets, and establish remote access without requiring victims to execute the received code.
chainlink-api-v3.com /api/service/token/… 80 Stage 1 & 5: Delivers JS payload via Error 404
146.70.253.107 /client/5346/1014 1224 Stage 2: Downloads Python Stager (.nlp)
146.70.253.107 /payload/5346/1014 1224 Stage 3: Downloads RAT (way)
146.70.253.107 /brow/5346/1014 1224 Stage 3: Downloads Miner (pow)
146.70.253.107 /keys 2242 RAT: Data exfiltration & Command channel
172.86.116.178 /api/service/process 5918 Node RAT: vhost.ctl communication
172.86.116.178 /upload 5978 Exfiltration: Screenshot/Clipboard upload
SEAL's forensic analysis indicates that the malware prioritizes one-time data theft over long-term persistence, particularly on non-Windows platforms. However, consistent Indicators of Compromise (IOCs) were identified across victims' environments.
Attribution to DPRK operators is assessed with high confidence. The LinkedIn persona "John Meltzer" and the "Meta2140" project are likely controlled by North Korean IT workers, linked to previously known fraudulent activities.
Security measures such as enforcing strict VS Code workspace trust controls, disabling automatic tasks, and scanning for hidden artifacts are recommended for developers handling unsolicited code.
Based on reporting by GBHackers.