# Contagious Interview IDE Task Hijacking — North Korean BeaverTail/PyLangGhost/GolangGhost via VS Code & Cursor Tasks, GitHub Gist Staging, Developer Targeting

> North Korean Contagious Interview actors (Lazarus subgroup) abuse IDE task auto-execution in VS Code and Cursor to deliver BeaverTail, PyLangGhost, and GolangGhost backdoors to software developers. Malicious tasks.json files execute curl/wget/PowerShell downloaders fetching payloads from GitHub Gists, URL shorteners (short.gy), Google Drive, and custom domains masquerading as NVIDIA software (camdriver.pro). Primary targets are DeFi/cryptocurrency developers recruited through fake job interviews.

- **Published:** 2026-02-26T15:18:00Z
- **Last reviewed:** 2026-02-26T15:18:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0148
- **ID:** TL-2026-0148
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Contagious Interview (North Korea)
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Contagious Interview (also tracked as DeceptiveDevelopment and Famous Chollima) is a North Korean threat cluster that targets software developers through fake job interviews. The campaign has evolved to abuse IDE task auto-execution in Visual Studio Code and Cursor IDE. When a developer clones a malicious repository and opens it in VS Code or Cursor, tasks.json files configured with 'runOn: folderOpen' triggers automatically execute malicious commands without user confirmation.

Abstract Security ASTRO identified multiple infection chains in February 2026:

1. **GitHub Gist Chain**: Repositories contain tasks.json files that execute curl/wget commands fetching stager scripts from GitHub Gists hosted by the 'cuda-toolkit' user account. The Gist filenames (cuda_toolkit_sim_v12.4.ps1, metal_pytorch_sim_v2.3.0.sh) masquerade as NVIDIA software — a deliberate choice targeting GPU-using DeFi developers. The stager scripts then download next-stage payloads from camdriver.pro (posing as camera/Realtek drivers), with URL parameters containing UUIDs for tracking. Platform-specific URLs: realtekwin.update (Windows) and realtekmac.sh (macOS/Linux). These chains deploy GolangGhost and PyLangGhost backdoors previously documented by ESET WeLiveSecurity.

2. **URL Shortener Chain**: 22+ repositories contain tasks.json files using short.gy URL shorteners that redirect to josehub88.vercel.app. Many files feature whitespace padding to push malicious commands off-screen in the IDE editor — a cheap evasion technique. These chains deploy BeaverTail downloaders.

3. **Novel Loader Chain (nomgwenya.co.za)**: A malicious fork of the Shannon AI penetration testing framework (adadsws/shannon) contains a Windows-targeting tasks.json that downloads a batch script from nomgwenya.co.za. The infection chain is sophisticated: the second-stage loader (vscode-bootstrap.cmd) is written to %USERPROFILE%\.vscode, re-launches in a hidden window using a _restarted sentinel argument, downloads a portable Node.js MSI via msiexec, then uses certutil to decode a JavaScript payload embedded in PEM certificate headers within the batch file itself. The decoded JavaScript implements a custom stack-based bytecode VM (~30 opcodes) with rolling XOR cipher decryption. The VM downloads a PyArmor-protected Python payload from postprocesser.com/.well-known/pki-validation/go/python3.zip, spawns pythonw.exe (windowless) as a detached process with environment variable REALTEKAUDIO carrying encoded data.

4. **Google Drive Chain**: The malicious npm package 'eslint-validator' (published by lincoln0809) fetches and executes JavaScript from a Google Drive URL. The code handles virus-scan warning pages by falling back to drive.usercontent.google.com download endpoints. The Google Drive-hosted file (inject-simple.min0.js) contains heavily obfuscated BeaverTail downloader code.

The campaign targets both VS Code (.vscode/tasks.json) and Cursor (.cursor/tasks.json) IDE configurations. Cursor support represents expansion into AI-powered development tools. The actors actively rotate infrastructure: Vercel domains, GitHub Gists, URL shorteners, Google Drive, and custom domains — adapting to community reporting and platform takedowns.

BeaverTail is a JavaScript-based downloader/stealer targeting cryptocurrency wallets and browser credentials. PyLangGhost is a Python-based backdoor with remote access capabilities. GolangGhost is a Go-based backdoor used for persistent access. All three malware families are attributed to the Lazarus Group's Contagious Interview subcluster.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1566.003 Spearphishing via Service
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1059.006 Python
- T1204.002 Malicious File
- T1546 Event Triggered Execution
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1027.002 Software Packing
- T1564.003 Hidden Window
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102.002 Bidirectional Communication
- T1567 Exfiltration Over Web Service
- T1583.006 Web Services

## Sources

- [Abstract Security ASTRO — Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains (Part 1)](https://www.abstract.security/blog/contagious-interview-evolution-of-vscode-and-cursor-tasks-infection-chains)
- [Abstract Security ASTRO — Contagious Interview: Tracking the VS Code Tasks Infection Vector (Part 0)](https://www.abstract.security/blog/contagious-interview-tracking-the-vs-code-tasks-infection-vector)
- [ESET WeLiveSecurity — DeceptiveDevelopment: From Primitive Crypto Theft to Sophisticated AI-Based Deception](https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-from-primitive-crypto-theft-to-sophisticated-ai-based-deception/)
- [Malpedia — BeaverTail Family](https://malpedia.caad.fkie.fraunhofer.de/details/js.beavertail)
- [Malpedia — PyLangGhost Family](https://malpedia.caad.fkie.fraunhofer.de/details/py.pylangghost)
- [Malpedia — GolangGhost Family](https://malpedia.caad.fkie.fraunhofer.de/details/win.golangghost)
- [DPRK NPM Packages Tracker (kmsec.uk)](https://dprk-research.kmsec.uk/)
- [Threadlinqs — TL-2026-0147 SANDWORM_MODE (related: MCP/IDE config abuse)](https://intel.threadlinqs.com/threat/TL-2026-0147)
- [Threadlinqs — TL-2026-0146 Claude Code RCE (related: IDE config exploitation)](https://intel.threadlinqs.com/threat/TL-2026-0146)
- [Threadlinqs — TL-2026-0140 Lazarus Medusa Ransomware (related: DPRK operations)](https://intel.threadlinqs.com/threat/TL-2026-0140)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0148