North Korean Hackers use Code Abuse Tactics for ‘Contagious Interview’ Campaign
North Korean threat actors have initiated a social engineering campaign targeting software developers with fraudulent recruitment offers. This operation, termed "Contagious Interview," utilizes deceptive repositories disguised as technical assessment…
North Korean threat actors have initiated a social engineering campaign targeting software developers with fraudulent recruitment offers. This operation, termed "Contagious Interview," utilizes deceptive repositories disguised as technical assessment projects to deploy a dual-layer malware system.
Victims are approached via LinkedIn by fake recruiters claiming association with entities such as Meta2140. They are then directed to download repositories that contain hidden malicious code.
The attack follows a two-stage infection process aimed at credential theft, cryptocurrency wallet access, and establishing remote access on compromised systems. The malware employs several infection vectors, including a concealed Visual Studio Code (VS Code) tasks configuration. Developers inadvertently trigger execution by opening the project folder or enabling AI-assisted code inspection.
Another vector involves application logic hooks in server code, which download and execute payloads via seemingly legitimate functions. If these methods fail, a malicious npm dependency is attempted. These tactics enable successful infections even when victims avoid direct code execution.
Security researchers at SEAL Intel identified and analyzed the campaign, noting significant financial losses among affected parties. The malware was traced back to known North Korean IT workers, with commit timestamps indicating Korean Standard Time, confirming attribution.
North Korean threat actors have initiated a social engineering campaign targeting software developers with fraudulent recruitment offers.
The infection mechanism operates in distinct stages. Once triggered, the malware downloads a Node.js controller that runs entirely in system memory. This controller deploys five specialized modules to exfiltrate data. The keylogger and screenshot module monitors user activity and uploads data to a command server.
A file grabber searches the home directory for configuration files and secrets, while a clipboard monitor watches for cryptocurrency addresses. The browser stealer targets databases in Chrome, Brave, and Opera for login credentials and wallet information.
A remote access tool connects to the attacker's server via socket.io, allowing execution of arbitrary shell commands. Following this, Python payloads establish stronger persistence, creating startup folder injections and scheduled tasks on Windows systems.
The miner module downloads XMRig cryptocurrency mining software, creating hidden directories in .npm and system folders to stage stolen data and maintain persistence across reboots.
Developers should disable automatic VS Code task execution and enable workspace trust verification. Systems showing infection signs, including hidden .n2, .n3, or .npm directories, require full credential rotation and cryptocurrency wallet migration to secure devices. Windows systems may necessitate a complete operating system reinstallation due to registry-level persistence mechanisms.
Based on reporting by Cyber Security News.