Contagious Interview IDE Task Hijacking — North Korean BeaverTail/PyLangGhost/GolangGhost via VS Code & Cursor Tasks, GitHub Gist Staging, Developer Targeting
Contagious Interview IDE Task Hijacking (TL-2026-0148), also tracked as Contagious Interview, is a high-severity advanced persistent threat campaign, first published 2026-02-26. It is attributed to Contagious Interview (North Korea) with high confidence, affects Microsoft Visual Studio Code, maps to 20 MITRE ATT&CK techniques (T1005, T1027.002, T1036.005), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-0148
- Threat ID
- TL-2026-0148
- Also known as
- Contagious Interview, DeceptiveDevelopment, Famous Chollima
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-02-26
- Last reviewed
- 2026-02-26
- Attribution
- Contagious Interview
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, defi, software-development, blockchain, fintech
- Target regions
- Global, North America, Europe, East Asia
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Contagious Interview IDE Task Hijacking
Malware and tooling: Beavertail, GolangGhost, PylangGhost, Cursor IDE, VS Code
North Korean Contagious Interview actors (Lazarus subgroup) abuse IDE task auto-execution in VS Code and Cursor to deliver BeaverTail, PyLangGhost, and GolangGhost backdoors to software developers. Malicious tasks.json files execute curl/wget/PowerShell downloaders fetching payloads from GitHub Gists, URL shorteners (short.gy), Google Drive, and custom domains masquerading as NVIDIA software (camdriver.pro). Primary targets are DeFi/cryptocurrency developers recruited through fake job interviews.
How Contagious Interview IDE Task Hijacking works
Contagious Interview (also tracked as DeceptiveDevelopment and Famous Chollima) is a North Korean threat cluster that targets software developers through fake job interviews. The campaign has evolved to abuse IDE task auto-execution in Visual Studio Code and Cursor IDE. When a developer clones a malicious repository and opens it in VS Code or Cursor, tasks.json files configured with 'runOn: folderOpen' triggers automatically execute malicious commands without user confirmation.
Abstract Security ASTRO identified multiple infection chains in February 2026:
1. **GitHub Gist Chain**: Repositories contain tasks.json files that execute curl/wget commands fetching stager scripts from GitHub Gists hosted by the 'cuda-toolkit' user account. The Gist filenames (cuda_toolkit_sim_v12.4.ps1, metal_pytorch_sim_v2.3.0.sh) masquerade as NVIDIA software — a deliberate choice targeting GPU-using DeFi developers. The stager scripts then download next-stage payloads from camdriver.pro (posing as camera/Realtek drivers), with URL parameters containing UUIDs for tracking. Platform-specific URLs: realtekwin.update (Windows) and realtekmac.sh (macOS/Linux). These chains deploy GolangGhost and PyLangGhost backdoors previously documented by ESET WeLiveSecurity.
2. **URL Shortener Chain**: 22+ repositories contain tasks.json files using short.gy URL shorteners that redirect to josehub88.vercel.app. Many files feature whitespace padding to push malicious commands off-screen in the IDE editor — a cheap evasion technique. These chains deploy BeaverTail downloaders.
3. **Novel Loader Chain (nomgwenya.co.za)**: A malicious fork of the Shannon AI penetration testing framework (adadsws/shannon) contains a Windows-targeting tasks.json that downloads a batch script from nomgwenya.co.za. The infection chain is sophisticated: the second-stage loader (vscode-bootstrap.cmd) is written to %USERPROFILE%\.vscode, re-launches in a hidden window using a _restarted sentinel argument, downloads a portable Node.js MSI via msiexec, then uses certutil to decode a JavaScript payload embedded in PEM certificate headers within the batch file itself. The decoded JavaScript implements a custom stack-based bytecode VM (~30 opcodes) with rolling XOR cipher decryption. The VM downloads a PyArmor-protected Python payload from postprocesser.com/.well-known/pki-validation/go/python3.zip, spawns pythonw.exe (windowless) as a detached process with environment variable REALTEKAUDIO carrying encoded data.
4. **Google Drive Chain**: The malicious npm package 'eslint-validator' (published by lincoln0809) fetches and executes JavaScript from a Google Drive URL. The code handles virus-scan warning pages by falling back to drive.usercontent.google.com download endpoints. The Google Drive-hosted file (inject-simple.min0.js) contains heavily obfuscated BeaverTail downloader code.
The campaign targets both VS Code (.vscode/tasks.json) and Cursor (.cursor/tasks.json) IDE configurations. Cursor support represents expansion into AI-powered development tools. The actors actively rotate infrastructure: Vercel domains, GitHub Gists, URL shorteners, Google Drive, and custom domains — adapting to community reporting and platform takedowns.
BeaverTail is a JavaScript-based downloader/stealer targeting cryptocurrency wallets and browser credentials. PyLangGhost is a Python-based backdoor with remote access capabilities. GolangGhost is a Go-based backdoor used for persistent access. All three malware families are attributed to the Lazarus Group's Contagious Interview subcluster.
MITRE ATT&CK techniques used in TL-2026-0148
collection
defense-evasion
T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hidden Window
execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer
initial-access
T1195.002 Compromise Software Supply Chain; T1566.003 Spearphishing via Service
privilege-escalation
T1546 Event Triggered Execution
credential-access
T1555.003 Credentials from Web Browsers
exfiltration
T1567 Exfiltration Over Web Service
resource-development
Affected products and versions in Contagious Interview IDE Task Hijacking
- Microsoft — Visual Studio Code
Vulnerable versions: All versions with task.allowAutomaticTasks enabled - Cursor — Cursor IDE
Vulnerable versions: All versions (tasks.json auto-execution) - npm — eslint-validator package
Vulnerable versions: Malicious package by lincoln0809
Fixed in: Package removed
Remediation for Contagious Interview IDE Task Hijacking
Immediate actions
- Audit all cloned repositories for .vscode/tasks.json and .cursor/tasks.json files with 'runOn: folderOpen' triggers
- Block domains: camdriver.pro, nomgwenya.co.za, postprocesser.com, josehub88.vercel.app at perimeter
- Search developer workstations for %USERPROFILE%\.vscode\vscode-bootstrap.cmd and %TEMP%\script_*.mjs artifacts
- Scan for REALTEKAUDIO environment variable — indicates active infection
- Review npm dependencies for 'eslint-validator' package and remove immediately
- Check for pythonw.exe running from %TEMP%\python3\ directories
Workarounds
- Set task.allowAutomaticTasks: 'off' in VS Code settings.json
- Review tasks.json files manually before opening repositories from unknown sources
- Block short.gy and gist.githubusercontent.com URLs in tasks.json via pre-commit hooks
- Use VS Code workspace trust feature — do not trust repositories from unknown sources
Longer-term hardening
- Disable VS Code task auto-execution: set task.allowAutomaticTasks to 'off' in VS Code settings
- Implement repository security scanning for tasks.json files containing curl/wget/PowerShell download commands
- Deploy EDR monitoring for IDE processes spawning shell interpreters or network download tools
- Establish allowlists for GitHub Actions and IDE task configurations in organizational policy
- Train developers on social engineering via fake job interview campaigns targeting the crypto/DeFi sector
- Monitor for certutil -decode usage targeting batch/cmd files (T1140)
Weaknesses (CWE) in Contagious Interview IDE Task Hijacking
CWE-829, CWE-506, CWE-94
Timeline of Contagious Interview IDE Task Hijacking
- Contagious Interview campaign first documented targeting developers via fake job interviews with npm-based infection vectors (pre-IDE-tasks era)
- First observations of VS Code tasks.json abuse for malware delivery — folderOpen trigger auto-executes curl/wget commands on repo open
- Abstract Security ASTRO publishes Part 0 report tracking VS Code tasks infection vector with Vercel-hosted stagers. Source: https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector
- ESET WeLiveSecurity publishes DeceptiveDevelopment report documenting GolangGhost and WeaselStore backdoors. Source: https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception/
- Contagious Interview actors diversify staging infrastructure: GitHub Gists (cuda-toolkit), short.gy URL shorteners, Google Drive, custom domains (camdriver.pro, nomgwenya.co.za, postprocesser.com)
- First .cursor/tasks.json files observed — campaign expands from VS Code to Cursor IDE targeting, reaching AI-powered development tools
- Abstract Security ASTRO publishes Part 1 report: GitHub Gist staging, novel bytecode VM loader, PyArmor payload, certutil PEM masquerade, and Cursor IDE targeting. Source: https://www.abstract.security/blog/contagious-interview-evolution-of-vscode-and-cursor-tasks-infection-chains
- Threadlinqs Intelligence publishes TL-2026-0148 with full MITRE mapping, simulations, and detection coverage
- As of 2026-05-29, this DPRK Contagious Interview/Famous Chollima campaign remains ACTIVE — the kmsec.uk DPRK tracker logs ~203 malicious npm releases (109 packages) in the trailing 30 days, latest 2026-05-28. Trend Micro's April 2026 Void Dokkaebi report confirms the same VS Code tasks.json hijack TTP now self-propagating, and no CVE/takedown ended it.
Sources cited for Contagious Interview IDE Task Hijacking
- Abstract Security ASTRO — Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains (Part 1)
- Abstract Security ASTRO — Contagious Interview: Tracking the VS Code Tasks Infection Vector (Part 0)
- ESET WeLiveSecurity — DeceptiveDevelopment: From Primitive Crypto Theft to Sophisticated AI-Based Deception
- Malpedia — BeaverTail Family
- Malpedia — PyLangGhost Family
- Malpedia — GolangGhost Family
- DPRK NPM Packages Tracker (kmsec.uk)
- Threadlinqs — TL-2026-0147 SANDWORM_MODE (related: MCP/IDE config abuse)
- Threadlinqs — TL-2026-0146 Claude Code RCE (related: IDE config exploitation)
- Threadlinqs — TL-2026-0140 Lazarus Medusa Ransomware (related: DPRK operations)
Threats related to Contagious Interview IDE Task Hijacking
- Famous Chollima (DPRK) npm Supply Chain — Pastebin Text Steganography Dead-Drop Resolver, 17 Malicious Packages, Vercel C2 Infrastructure
- Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret Loader in Git Hooks via precommit.vercel.app — Contagious Interview / TaskJacker Evolution (May 2026)
- Malicious Next.js Repositories — Developer-Targeting C2 Campaign via VSCode Workspace Abuse, Job-Themed Lures, and Staged JavaScript Execution
- Contagious Interview: DPRK Campaign Delivers OtterCookie and FlexibleFerret Backdoors via Fake Developer Job Interviews
- North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer Credentials
- KelpDAO LayerZero Bridge Exploit — $292M rsETH Minted Against Non-Existent Burn (Lazarus Group, April 2026)
Detection coverage for TL-2026-0148
As of 2026-02-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0148 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.