# DPRK Contagious Interview Supply Chain RAT Campaign via npm, PyPI, and Multi-Ecosystem Package Poisoning

> North Korean Lazarus Group operates the Contagious Interview campaign, publishing 1,700+ malicious packages across npm, PyPI, Go, Rust, and PHP ecosystems. The campaign uses fake job recruitment lures to trick developers into executing trojanized packages that deploy BeaverTail infostealer, InvisibleFerret RAT, and OtterCookie backdoor for persistent access, credential theft, and cryptocurrency wallet exfiltration.

- **Published:** 2026-04-07T12:00:00Z
- **Last reviewed:** 2026-04-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0332
- **ID:** TL-2026-0332
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Contagious Interview campaign is a persistent, multi-ecosystem software supply chain attack operated by DPRK-linked threat actors under the Lazarus Group umbrella (tracked as Jade Sleet, TraderTraitor, UNC4899, Famous Chollima, and Tenacious Pungsan). Active since at least mid-2024 and intensifying through 2026, the operation has published over 1,700 malicious packages across npm, PyPI, Go, Rust, and PHP registries, accumulating more than 50,000 downloads.

The attack chain begins with social engineering: operators create fake recruiter personas on LinkedIn, Facebook, Reddit, and job boards (Freelancer.com, Upwork, CryptoJobsList), impersonating hiring managers from cryptocurrency, blockchain, and AI companies. Victims — typically software developers and Web3 engineers — are directed to clone GitHub or Bitbucket repositories containing coding assessments. These repositories include malicious dependencies that trigger upon npm install or pip install.

Three front companies were established to support the campaign: BlockNovas LLC (blocknovas.com), Angeloper Agency (angeloper.com), and SoftGlide LLC (softglide.co), all registered with fabricated addresses and AI-generated employee profile photos created via remaker.ai.

The malware delivery chain employs multiple loader families. The HexEval loader uses hex-encoded strings to evade static analysis, decoding module names and C2 URLs at runtime before issuing HTTPS POST requests to retrieve second-stage payloads via eval(). The XORIndex loader and encrypted loaders reconstruct malicious code directly in memory to bypass disk-based detection. Lifecycle hooks (postinstall) in npm packages serve as the initial execution trigger.

The primary malware families include:

1. BeaverTail — A JavaScript-based infostealer and downloader. It scans approximately 200 browser profile directories for cookies and IndexedDB files, targets cryptocurrency wallets (Solana id.json, Exodus, MetaMask, and 24+ browser extension wallets), extracts macOS Login Keychain data, and downloads the next-stage payload.

2. InvisibleFerret — A cross-platform Python-based RAT downloaded from C2 servers via URL pattern http://<C2>:1224/client/3/<campaign_id>. Capabilities include persistent remote command execution, file manipulation, process enumeration, and data exfiltration to C2 upload endpoints.

3. OtterCookie — A JavaScript-based backdoor first observed in September 2024, evolved into a modular platform with VM detection, socket.io-based C2 communication, data exfiltration, and arbitrary shell command execution.

4. FrostyFerret — A Golang backdoor with hardcoded C2 configuration used in later campaign waves.

Additional capabilities observed include cross-platform keyloggers (WinKeyServer, MacKeyServer, X11KeyServer) deployed via the jsonsecs package variant, screenshot capture, clipboard monitoring, mouse/keyboard remote control, and SSH/GPG/AWS credential theft.

C2 infrastructure leverages a mix of Vercel-hosted API endpoints for initial beaconing (log-server-lovat.vercel.app, ip-check-server.vercel.app), raw IP addresses on commodity VPS providers (RouterHosting/Cloudzy AS14956, Hetzner, TheHosting/WorkTitans), and legitimate services (Bitbucket, jsonkeeper.com paste service). Characteristic port signatures include 1224, 1244, 5918, 5934, 5961, and 5974 — any server presenting these simultaneously is assessed as Lazarus infrastructure.

The campaign has been attributed with high confidence to DPRK state-sponsored actors based on infrastructure overlaps with previously documented Lazarus operations, the use of Astrill VPN (documented as DPRK's VPN of choice with 19 Astrill VPN IPs found in victim logs), persona connections to known Lazarus operators, token-based C2 communication patterns matching 2023 Jade Sleet campaigns, and OPSEC failures exposing monitoring dashboards tracking campaign infrastructure.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1195 Supply Chain Compromise
- T1566 Phishing
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1202 Indirect Command Execution
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1082 System Information Discovery
- T1217 Browser Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1113 Screen Capture
- T1115 Clipboard Data
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Socket: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages](https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages)
- [The Hacker News: Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems](https://thehackernews.com/2026/02/lazarus-campaign-plants-malicious.html)
- [SafeDep: Malicious npm Package express-session-js Drops Full RAT Payload](https://safedep.io/malicious-npm-package-express-session-js/)
- [Microsoft: Contagious Interview — Malware Delivered Through Fake Developer Job Interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [Google Cloud: North Korea-Nexus Threat Actor Compromises Axios NPM Package](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)
- [Datadog Security Labs: Tenacious Pungsan — DPRK Contagious Interview](https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/)
- [eSecurity Planet: 338 Malicious npm Packages Linked to North Korean Hackers](https://www.esecurityplanet.com/news/338-malicious-npm-packages-linked-to-north-korean-hackers/)
- [Silent Push: Contagious Interview Creates Three Front Companies to Deliver Malware](https://www.silentpush.com/blog/contagious-interview-front-companies/)
- [Unit42: North Korean Threat Actors Lure Tech Job Seekers with BeaverTail and InvisibleFerret](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/)
- [SANS: Hunting North Korea's State-Sponsored Contagious Interview Operation](https://www.sans.org/presentations/hunting-north-koreas-state-sponsored-contagious-interview-operation-attacks-on-developers-via-the-software-supply-chain)
- [Breakglass Intel: Mapping DPRK Contagious Interview From InvisibleFerret to Kimsuky Crossover](https://intel.breakglass.tech/post/invisibleferret-contagious-interview-dprk-lazarus-kimsuky-crossover)
- [Recorded Future: PurpleBravo's Targeting of the IT Software Supply Chain](https://www.recordedfuture.com/research/purplebravos-targeting-it-software-supply-chain)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0332