# Contagious Interview: DPRK Campaign Delivers OtterCookie and FlexibleFerret Backdoors via Fake Developer Job Interviews

> North Korean threat actors are conducting an active social engineering campaign dubbed Contagious Interview, posing as recruiters from cryptocurrency and AI companies to deliver OtterCookie, FlexibleFerret, BeaverTail, and InvisibleFerret backdoors through weaponized coding assessments and fake video interview software. The campaign targets software developers globally to exfiltrate API tokens, cloud credentials, cryptocurrency wallets, and source code.

- **Published:** 2026-03-11T12:00:00Z
- **Last reviewed:** 2026-03-11T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0213
- **ID:** TL-2026-0213
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Contagious Interview is a persistent, multi-stage social engineering campaign attributed to DPRK-aligned threat actors tracked as Famous Chollima, Tenacious Pungsan, and DEV#POPPER (MITRE G1052). Active since at least November 2023, the campaign has evolved significantly through 2024-2026 with expanding infrastructure, new malware families, and increasingly sophisticated delivery mechanisms.

The attack chain begins with threat actors establishing fake front companies — BlockNovas LLC (blocknovas.com), Angeloper Agency (angeloper.com), and SoftGlide LLC (softglide.co) — and creating AI-generated employee personas to post job listings on platforms including LinkedIn, CryptoJobsList, Upwork, Freelancer, and GitHub. Targets are primarily software developers in the cryptocurrency, blockchain, Web3, and artificial intelligence sectors.

Victims are lured through a multi-stage interview process: initial contact via LinkedIn or job boards, followed by a video interview that triggers a fake camera/microphone error. The victim is then prompted to install malicious software disguised as VCam, CameraAccess, or ChromeUpdate — or to execute a ClickFix-style Terminal command that downloads and executes the first-stage payload.

The malware arsenal includes four primary families: BeaverTail (JavaScript-based infostealer distributed via malicious npm packages using HexEval and XORIndex obfuscation), InvisibleFerret (Python-based multi-stage backdoor providing persistent remote access), OtterCookie (JavaScript/Node.js backdoor communicating via Socket.IO on non-standard port 1224 for credential theft, clipboard exfiltration, and shell command execution), and the FERRET family on macOS — FrostyFerret (Golang first-stage dropper), FriendlyFerret (Go backdoor masquerading as com.apple.secd), and FlexibleFerret (signed with a valid but now-revoked Apple Developer certificate, Team ID 58CD8AD5Z4, establishing LaunchAgent persistence and exfiltrating data via Dropbox API).

The npm supply chain component is particularly aggressive: over 338 malicious packages with 50,000+ cumulative downloads have been identified since July 2025, using namesquatting against legitimate libraries (passports-js, bcrypts-js, blockscan-api, postcss-optimizer). These packages reconstruct BeaverTail in memory, which then drops InvisibleFerret for persistent access.

C2 infrastructure spans multiple domains and IPs, with primary servers at lianxinxiao.com (37.221.126.117), chainlink-api-v3.cloud, zoom.callservice.us, and camdriversupport.com. Actors route through Astrill VPN exit nodes across 19+ IPs to obscure attribution. The campaign has resulted in confirmed financial losses including cryptocurrency wallet compromises and source code theft from developer endpoints.

---

**Revalidated on 2026-03-12**

Since the last update, the Contagious Interview campaign has undergone five significant evolutions that expand its threat profile:

**Law Enforcement Action (April 2025):** The FBI seized the BlockNovas.com domain on April 23, 2025, as part of a law enforcement action against DPRK cyber actors for using it to deceive individuals with fake job postings and distribute malware. However, the Angeloper and SoftGlide infrastructure remained operational, and the campaign rapidly spun up replacement infrastructure.

**Operational Exposure (Mid-2025):** SentinelLABS, in collaboration with Validin, analyzed exposed log files from Contagious Interview servers revealing 230+ confirmed victims between January and March 2025 alone. The research showed threat actors using Slack channels for real-time coordination and actively monitoring cyber threat intelligence platforms (Validin, VirusTotal, Maltrail) -- registering accounts on Validin within 24 hours of publications referencing their infrastructure. This counter-intelligence awareness underscores the sophistication of the operation.

**IDE Infection Vector (Late 2025):** The campaign adopted VS Code and Cursor IDE task file abuse as a new infection mechanism. Malicious .vscode/tasks.json files embedded in GitHub and GitLab repositories achieve silent code execution when developers open cloned projects and trust the workspace. Once trusted, subsequent malicious pushes to the same repository execute without any user prompt, establishing a persistent supply chain risk.

**Blockchain-Based Bulletproof C2 -- EtherHiding (October 2025):** Google Threat Intelligence Group (GTIG) disclosed that UNC5342 (overlapping with Contagious Interview) adopted EtherHiding, embedding encrypted JavaScript payloads in smart contracts on BNB Smart Chain and Ethereum. The JADESNOW downloader queries these contracts to fetch and execute InvisibleFerret, creating C2 infrastructure that is effectively immune to traditional takedown methods since blockchain data is immutable and decentralized. This marks the first documented nation-state adoption of blockchain-based malware delivery.

**StegaBin Sub-Campaign (March 2026):** Socket researchers discovered 26 new malicious npm packages using a novel steganographic technique: Pastebin dead-drop resolvers where C2 URLs are hidden using zero-width Unicode characters within benign-looking essays. The decoded URLs point to 31 Vercel deployments that serve a 9-module cross-platform infostealer/RAT toolkit. Modules include a keylogger, mouse tracker, clipboard stealer, Python-based browser credential harvester, TruffleHog scanner for secrets in git repos, cryptocurrency exfiltration module, and a StegaBin loader. The toolkit specifically targets developer environments: VSCode configuration, SSH keys, git repositories, and locally stored secrets. This represents a significant increase in post-compromise capability compared to earlier OtterCookie variants.

Additionally, GitLab banned 131 accounts attributed to North Korean malicious code distribution, and the total count of malicious npm packages linked to the campaign now exceeds 600 across all waves (338 in the July 2025 Socket report, 197 in November 2025, 26 in the March 2026 StegaBin wave, plus earlier waves).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1566 Phishing
- T1684.001 Impersonation
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1115 Clipboard Data
- T1005 Data from Local System
- T1113 Screen Capture
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1090 Proxy
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft

## Sources

- [SentinelOne: macOS FlexibleFerret - Further Variants of DPRK Malware Family Unearthed](https://www.sentinelone.com/blog/macos-flexibleferret-further-variants-of-dprk-malware-family-unearthed/)
- [Silent Push: Contagious Interview Front Companies](https://www.silentpush.com/blog/contagious-interview-front-companies/)
- [ANY.RUN: OtterCookie Malware Analysis](https://any.run/cybersecurity-blog/ottercookie-malware-analysis/)
- [MITRE ATT&CK: Contagious Interview G1052](https://attack.mitre.org/groups/G1052/)
- [Datadog: Tenacious Pungsan - DPRK Threat Actor Contagious Interview](https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/)
- [The Hacker News: North Korean Hackers Deploy FERRET Malware via Fake Job Interviews on macOS](https://thehackernews.com/2025/02/north-korean-hackers-deploy-ferret.html)
- [Socket.dev: North Korea Contagious Interview 338 Malicious npm Packages](https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages)
- [Palo Alto Unit 42: North Korean Threat Actors Lure Tech Industry Job Seekers](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/)
- [The Hacker News: North Korean Hackers Deploy 197 npm Packages Spreading OtterCookie](https://thehackernews.com/2025/11/north-korean-hackers-deploy-197-npm.html)
- [GitLab Threat Intelligence: North Korean Tradecraft](https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/)
- [Dark Reading: DPRK FlexibleFerret Tightens macOS Grip](https://www.darkreading.com/cyberattacks-data-breaches/dprks-flexibleferret-tightens-macos-grip)
- [Microsoft Security Blog: Contagious Interview Malware](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0213