Contagious Interview: DPRK Campaign Delivers OtterCookie and FlexibleFerret Backdoors via Fake Developer Job Interviews

Contagious Interview (TL-2026-0213), also tracked as Contagious Interview, is a high-severity advanced persistent threat campaign, first published 2026-03-11. It is attributed to WageMole (North Korea) with high confidence, affects npm npm Registry, maps to 38 MITRE ATT&CK techniques (T1003, T1005, T1027), and is covered by 9 detection rules and 40 indicators of compromise.

Key facts for TL-2026-0213

Threat ID
TL-2026-0213
Also known as
Contagious Interview, ClickFake Interview, Operation Dream Job variant
Severity
HIGH
Status
ACTIVE
Category
APT
First published
2026-03-11
Last reviewed
2026-03-11
Attribution
WageMole
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
cryptocurrency, artificial-intelligence, software-development, blockchain, web3, financial-services, technology
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
40

Malware and tooling in Contagious Interview

Malware and tooling: BeaverTail - S1246, FlexibleFerret, FriendlyFerret, FrostyFerret, InvisibleFerret - S1245, OtterCookie, Socket.IO

North Korean threat actors are conducting an active social engineering campaign dubbed Contagious Interview, posing as recruiters from cryptocurrency and AI companies to deliver OtterCookie, FlexibleFerret, BeaverTail, and InvisibleFerret backdoors through weaponized coding assessments and fake video interview software. The campaign targets software developers globally to exfiltrate API tokens, cloud credentials, cryptocurrency wallets, and source code.

How Contagious Interview works

Contagious Interview is a persistent, multi-stage social engineering campaign attributed to DPRK-aligned threat actors tracked as Famous Chollima, Tenacious Pungsan, and DEV#POPPER (MITRE G1052). Active since at least November 2023, the campaign has evolved significantly through 2024-2026 with expanding infrastructure, new malware families, and increasingly sophisticated delivery mechanisms.

The attack chain begins with threat actors establishing fake front companies — BlockNovas LLC (blocknovas.com), Angeloper Agency (angeloper.com), and SoftGlide LLC (softglide.co) — and creating AI-generated employee personas to post job listings on platforms including LinkedIn, CryptoJobsList, Upwork, Freelancer, and GitHub. Targets are primarily software developers in the cryptocurrency, blockchain, Web3, and artificial intelligence sectors.

Victims are lured through a multi-stage interview process: initial contact via LinkedIn or job boards, followed by a video interview that triggers a fake camera/microphone error. The victim is then prompted to install malicious software disguised as VCam, CameraAccess, or ChromeUpdate — or to execute a ClickFix-style Terminal command that downloads and executes the first-stage payload.

The malware arsenal includes four primary families: BeaverTail (JavaScript-based infostealer distributed via malicious npm packages using HexEval and XORIndex obfuscation), InvisibleFerret (Python-based multi-stage backdoor providing persistent remote access), OtterCookie (JavaScript/Node.js backdoor communicating via Socket.IO on non-standard port 1224 for credential theft, clipboard exfiltration, and shell command execution), and the FERRET family on macOS — FrostyFerret (Golang first-stage dropper), FriendlyFerret (Go backdoor masquerading as com.apple.secd), and FlexibleFerret (signed with a valid but now-revoked Apple Developer certificate, Team ID 58CD8AD5Z4, establishing LaunchAgent persistence and exfiltrating data via Dropbox API).

The npm supply chain component is particularly aggressive: over 338 malicious packages with 50,000+ cumulative downloads have been identified since July 2025, using namesquatting against legitimate libraries (passports-js, bcrypts-js, blockscan-api, postcss-optimizer). These packages reconstruct BeaverTail in memory, which then drops InvisibleFerret for persistent access.

C2 infrastructure spans multiple domains and IPs, with primary servers at lianxinxiao.com (37.221.126.117), chainlink-api-v3.cloud, zoom.callservice.us, and camdriversupport.com. Actors route through Astrill VPN exit nodes across 19+ IPs to obscure attribution. The campaign has resulted in confirmed financial losses including cryptocurrency wallet compromises and source code theft from developer endpoints.

---

**Revalidated on 2026-03-12**

Since the last update, the Contagious Interview campaign has undergone five significant evolutions that expand its threat profile:

**Law Enforcement Action (April 2025):** The FBI seized the BlockNovas.com domain on April 23, 2025, as part of a law enforcement action against DPRK cyber actors for using it to deceive individuals with fake job postings and distribute malware. However, the Angeloper and SoftGlide infrastructure remained operational, and the campaign rapidly spun up replacement infrastructure.

**Operational Exposure (Mid-2025):** SentinelLABS, in collaboration with Validin, analyzed exposed log files from Contagious Interview servers revealing 230+ confirmed victims between January and March 2025 alone. The research showed threat actors using Slack channels for real-time coordination and actively monitoring cyber threat intelligence platforms (Validin, VirusTotal, Maltrail) -- registering accounts on Validin within 24 hours of publications referencing their infrastructure. This counter-intelligence awareness underscores the sophistication of the operation.

**IDE Infection Vector (Late 2025):** The campaign adopted VS Code and Cursor IDE task file abuse as a new infection mechanism. Malicious .vscode/tasks.json files embedded in GitHub and GitLab repositories achieve silent code execution when developers open cloned projects and trust the workspace. Once trusted, subsequent malicious pushes to the same repository execute without any user prompt, establishing a persistent supply chain risk.

**Blockchain-Based Bulletproof C2 -- EtherHiding (October 2025):** Google Threat Intelligence Group (GTIG) disclosed that UNC5342 (overlapping with Contagious Interview) adopted EtherHiding, embedding encrypted JavaScript payloads in smart contracts on BNB Smart Chain and Ethereum. The JADESNOW downloader queries these contracts to fetch and execute InvisibleFerret, creating C2 infrastructure that is effectively immune to traditional takedown methods since blockchain data is immutable and decentralized. This marks the first documented nation-state adoption of blockchain-based malware delivery.

**StegaBin Sub-Campaign (March 2026):** Socket researchers discovered 26 new malicious npm packages using a novel steganographic technique: Pastebin dead-drop resolvers where C2 URLs are hidden using zero-width Unicode characters within benign-looking essays. The decoded URLs point to 31 Vercel deployments that serve a 9-module cross-platform infostealer/RAT toolkit. Modules include a keylogger, mouse tracker, clipboard stealer, Python-based browser credential harvester, TruffleHog scanner for secrets in git repos, cryptocurrency exfiltration module, and a StegaBin loader. The toolkit specifically targets developer environments: VSCode configuration, SSH keys, git repositories, and locally stored secrets. This represents a significant increase in post-compromise capability compared to earlier OtterCookie variants.

Additionally, GitLab banned 131 accounts attributed to North Korean malicious code distribution, and the total count of malicious npm packages linked to the campaign now exceeds 600 across all waves (338 in the July 2025 Socket report, 197 in November 2025, 26 in the March 2026 StegaBin wave, plus earlier waves).

MITRE ATT&CK techniques used in TL-2026-0213

credential-access

T1003 OS Credential Dumping; T1555 Credentials from Password Stores

collection

T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1497 Virtualization/Sandbox Evasion

exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

initial-access

T1195 Supply Chain Compromise; T1566 Phishing

persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

privilege-escalation

T1546 Event Triggered Execution

resource-development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities

reconnaissance

T1589 Gather Victim Identity Information; T1593 Search Open Websites/Domains

impact

T1657 Financial Theft

stealth

T1684.001 Impersonation

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Contagious Interview

  • npm — npm Registry
    Vulnerable versions: 338+ malicious packages identified
    Fixed in: Packages removed upon detection
  • Apple — macOS
    Vulnerable versions: All versions susceptible to FlexibleFerret signed with valid cert
    Fixed in: XProtect signatures updated for known FERRET variants
  • Microsoft — Windows
    Vulnerable versions: All versions via Node.js/Python backdoors
  • Linux — Linux distributions
    Vulnerable versions: All distributions running Node.js

Remediation for Contagious Interview

Immediate actions

  • Block known C2 domains: lianxinxiao.com, chainlink-api-v3.cloud, zoom.callservice.us, camdriversupport.com, easydriver.cloud, blocknovas.com, angeloper.com, softglide.co
  • Block C2 IPs: 37.221.126.117, 144.172.101.45, 86.104.74.169, 95.164.17.24 at perimeter firewalls
  • Audit npm dependencies for known malicious packages: passports-js, bcrypts-js, blockscan-api, postcss-optimizer
  • Review LaunchAgent plist files on macOS endpoints for com.zoom.plist or suspicious entries targeting /var/tmp/
  • Scan developer workstations for FlexibleFerret IOCs including InstallerAlert binaries and versus.pkg
  • Revoke and rotate any API tokens, cloud credentials, or cryptocurrency wallet keys on potentially compromised developer machines

Workarounds

  • Disable execution of unsigned applications on macOS via Gatekeeper strict mode
  • Block curl/wget downloads from unknown domains on developer workstations
  • Require MFA on all developer accounts and cryptocurrency wallets
  • Use verified company domains and video conferencing platforms for interviews only

Longer-term hardening

  • Deploy EDR with behavioral detection for Socket.IO C2 communications on non-standard ports
  • Implement npm audit policies and lockfile integrity verification in CI/CD pipelines
  • Enable macOS XProtect signature updates and validate detection of FERRET family variants
  • Conduct security awareness training focused on fake job interview social engineering tactics
  • Implement network segmentation to isolate developer environments from production systems
  • Deploy browser extension monitoring to detect unauthorized cryptocurrency wallet access

Weaknesses (CWE) in Contagious Interview

CWE-506, CWE-829

Timeline of Contagious Interview

Showing the 20 most recent tracked events.

  • lianxinxiao.com C2 server begins operations at 37.221.126.117, serving as primary staging infrastructure
  • First malicious npm packages (passports-js v0.7.0) published by threat actor account superdev727, containing BeaverTail loader
  • First public victim disclosure by developer topninja on dev.to reporting MetaMask wallet compromise following fake job interview
  • Datadog Security Labs attributes npm supply chain attacks to Tenacious Pungsan DPRK threat actor cluster
  • Palo Alto Unit 42 publishes comprehensive analysis linking BeaverTail and InvisibleFerret to DPRK Contagious Interview campaign
  • NTT Security reveals OtterCookie as new JavaScript backdoor component using Socket.IO C2 on port 1224
  • SentinelOne discovers FlexibleFerret macOS variant signed with valid Apple Developer certificate (Team ID 58CD8AD5Z4), evading XProtect
  • FERRET malware family documented: FrostyFerret (dropper), FriendlyFerret (Go backdoor), FlexibleFerret (persistent macOS implant)
  • FBI seizes BlockNovas.com domain as part of law enforcement action against DPRK Contagious Interview front company infrastructure used to deceive individuals with fake job postings and distribute malware [Source: https://thehackernews.com/2025/04/north-korean-hackers-spread-malware-via.html]
  • Silent Push exposes three DPRK front companies (BlockNovas, Angeloper, SoftGlide) with AI-generated personas used for recruitment lures
  • Socket.dev identifies 35 new malicious npm packages across 24 npm accounts, campaign pivots to HexEval loader that fetches BeaverTail on demand with minimal registry evidence [Source: https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages]
  • Socket.dev identifies 338+ malicious npm packages with 50,000+ cumulative downloads, campaign continues expanding supply chain vector
  • SentinelLABS and Validin publish joint research exposing Contagious Interview operational details: 230+ confirmed victims in Q1 2025, threat actors using Slack for coordination, actively monitoring CTI platforms within 24 hours of publications mentioning their infrastructure [Source: https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/]
  • Abstract Security and Jamf Threat Labs document VS Code tasks.json abuse as new infection vector -- malicious .vscode/tasks.json files in cloned GitHub/GitLab repos achieve silent code execution when developers open projects and trust workspace [Source: https://www.darkreading.com/cyber-risk/contagious-interview-attack-delivers-backdoor]
  • Google GTIG discloses UNC5342 adoption of EtherHiding technique: JADESNOW malware fetches encrypted JavaScript payloads from BNB Smart Chain and Ethereum smart contracts to deliver InvisibleFerret, marking first nation-state use of blockchain-based bulletproof C2 [Source: https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding]
  • Updated OtterCookie variant deployed via 197 new npm packages combining BeaverTail and prior OtterCookie capabilities
  • GitLab Threat Intelligence bans 131 unique accounts distributing malicious code projects attributed to North Korean nation-state threat actors linked to Contagious Interview [Source: https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/]
  • Socket discovers StegaBin sub-campaign: 26 new malicious npm packages using Pastebin steganographic dead-drop resolvers to hide C2 infrastructure across 31 Vercel deployments, delivering 9-module cross-platform infostealer/RAT toolkit [Source: https://socket.dev/blog/stegabin-26-malicious-npm-packages-use-pastebin-steganography]
  • Microsoft Security Blog publishes advisory on continued Contagious Interview campaign activity with expanded malware delivery through fake developer job interviews
  • As of 2026-05-29, the DPRK Contagious Interview campaign (Famous Chollima) remains fully active, with 204 malicious npm releases from 109 packages observed April 25-May 25 2026 plus new StegaBin/PromptMink sub-campaigns. OtterCookie and FlexibleFerret variants are still tracked in the wild by Microsoft and SentinelOne; no CVE, no successor, actor not disrupted.

Sources cited for Contagious Interview

Threats related to Contagious Interview

Detection coverage for TL-2026-0213

As of 2026-03-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0213 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats