Void Dokkaebi (Contagious Interview / Famous Chollima) — DPRK Fake Job Interview Campaign Delivering BeaverTail, InvisibleFerret, OtterCookie & GolangGhost via Trojanized Code Repositories
Void Dokkaebi (Contagious Interview / Famous Chollima) (TL-2026-0402), also tracked as Void Dokkaebi, is a high-severity advanced persistent threat campaign, first published 2026-04-21. It is attributed to WageMole (North Korea) with high confidence, affects Node.js Foundation / OpenJS Node.js runtime + npm ecosystem, maps to 37 MITRE ATT&CK techniques (T1027, T1036.005, T1041), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-0402
- Threat ID
- TL-2026-0402
- Also known as
- Void Dokkaebi, Contagious Interview, CL-STA-0240, Famous Chollima, DeceptiveDevelopment, UNC5342
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-04-21
- Last reviewed
- 2026-04-21
- Attribution
- WageMole
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cryptocurrency, blockchain, decentralized finance (DeFi), financial services, gaming, freelance / contractor developers, startups, fintech
- Target regions
- North America, Europe, South Korea, Japan, United Kingdom, India, Southeast Asia, Global (developer-centric)
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in Void Dokkaebi (Contagious Interview / Famous Chollima)
Malware and tooling: BeaverTail - S1246, GolangGhost (OS X), InvisibleFerret - S1245, OtterCookie, Tropidoor, AnyDesk, Custom HTTP + Socket.IO (OtterCookie)
Void Dokkaebi — tracked by Unit 42 as Contagious Interview (CL-STA-0240) and by CrowdStrike as Famous Chollima — is a DPRK-aligned cluster that social-engineers software developers via fake LinkedIn, X, GitHub, and freelance-platform recruiter personas into cloning and executing trojanized Node.js/Python/Go coding-assignment repositories. Execution of the repo (typically triggered by `npm install` or running a test harness) stages the BeaverTail JavaScript infostealer, the InvisibleFerret Python multi-stage backdoor, the newer OtterCookie JavaScript stealer, and Go-language GolangGhost variants to steal browser credentials, crypto wallets, and enable persistent remote access via AnyDesk — generating sanctioned-regime revenue and, in some victims, bridging into the overlapping DPRK IT-worker fraud program.
How Void Dokkaebi (Contagious Interview / Famous Chollima) works
Void Dokkaebi is the Trend Micro designation for a DPRK-aligned intrusion cluster overlapping with Palo Alto Unit 42's Contagious Interview (CL-STA-0240) and CrowdStrike's Famous Chollima. The cluster has been active since at least late 2022 and, per the 2026-04-21 Trend Micro writeup, has evolved its malware arsenal and lure infrastructure while maintaining the core 'fake job interview' social-engineering chain.
Initial access begins on professional and developer-facing platforms — LinkedIn, X (Twitter), GitHub, Upwork, Freelancer.com, We Work Remotely, and Telegram developer groups. Operators pose as recruiters or hiring managers at plausible but fictitious companies, or spoof well-known crypto and fintech brands, and open dialogue with targeted developers (particularly those listing JavaScript, Node.js, React, Python, Go, or Web3/Solidity skills). After rapport-building over several days, the operator schedules a 'technical interview' — frequently on hijacked or look-alike MiroTalk, freeconference, or Google Meet domains — and asks the candidate to clone a GitHub or Bitbucket repository presented as a 'coding assignment,' 'bug fix task,' or 'fork of our production code.'
The repositories are otherwise-functional Node.js, Python, or Go projects (often cryptocurrency dashboards, trading bots, or Web3 wallets) that contain obfuscated malicious code buried inside utility files, post-install hooks, or deeply nested package subdirectories. Execution paths include: (a) malicious `postinstall` or `preinstall` scripts in `package.json` that fire on `npm install`; (b) JavaScript loaders hidden inside minified or heavily commented test files; (c) Python `setup.py` hooks or runtime-imported modules; (d) Go-compiled droppers for GolangGhost variants. Developers running the repo — frequently on their own workstations rather than an isolated VM — execute the loader under their own user context.
Stage 1 (BeaverTail) is a heavily obfuscated JavaScript infostealer (and, in newer cross-platform variants, a Qt/Electron bundle) that enumerates and exfiltrates Chromium, Brave, Edge, Firefox, and Opera browser profile data (cookies, saved logins, autofill, extension data), targets ~20 cryptocurrency wallet browser extensions (MetaMask, Phantom, Binance Chain, Coinbase Wallet, TronLink, Trust Wallet, Exodus browser ext, Ronin, etc.), and harvests macOS Keychain, SSH keys, AWS/GCP credential files, and iCloud Keychain artifacts where reachable. BeaverTail then downloads Stage 2 from an operator-controlled C2 host.
Stage 2 (InvisibleFerret) is a Python-based modular backdoor delivered as compressed, base64-encoded payload chunks. Functionality includes: command execution, file enumeration and exfiltration, keylogging, screen capture, browser-credential and crypto-wallet stealing (complementary to BeaverTail), and the silent installation of AnyDesk as a persistent remote-management channel. InvisibleFerret establishes persistence via OS-specific mechanisms (LaunchAgents on macOS, Registry Run keys on Windows, systemd user units or cron on Linux).
OtterCookie — first documented by NTT Security in December 2024 and evolved across 2025 — is a newer JavaScript stealer variant occasionally deployed alongside or in place of BeaverTail. OtterCookie uses Socket.IO for C2, specifically targets cryptocurrency-related keychain items and wallet files, and carries an extended anti-analysis layer including VM detection. GolangGhost is a Go-language rewrite family observed in 2025-2026 that consolidates the stealer-plus-backdoor functionality into a single cross-platform (macOS-focused) binary — a direct response to endpoint detection improvements against the noisy JS/Python chain.
Stolen credentials, cryptocurrency, and system access are monetized directly (wallet draining) and used operationally to stage follow-on intrusions, including cases where the same victim is later re-targeted by DPRK IT-worker operators to exfiltrate corporate source code and IP. Revenue ultimately flows to the DPRK regime in violation of UN and US sanctions. The FBI, Mandiant, Microsoft Threat Intelligence, and multiple national CERTs have issued advisories emphasizing the cross-pollination between Contagious Interview (developer-as-victim) and the broader DPRK IT-worker fraud program (developer-as-insider).
MITRE ATT&CK techniques used in TL-2026-0402
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Persistence
T1053.003 Scheduled Task/Job: Cron; T1543.001 Create or Modify System Process: Launch Agent; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Credential Access
T1056.001 Input Capture: Keylogging; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573.001 Encrypted Channel: Symmetric Cryptography
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery
Collection
T1113 Screen Capture; T1119 Automated Collection; T1560 Archive Collected Data
Initial Access
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.003 Phishing: Spearphishing via Service
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server; T1585.001 Establish Accounts: Social Media Accounts; T1587.001 Develop Capabilities: Malware; T1608.001 Stage Capabilities: Upload Malware
Reconnaissance
T1589 Gather Victim Identity Information; T1593.001 Social Media
Impact
Affected products and versions in Void Dokkaebi (Contagious Interview / Famous Chollima)
- Node.js Foundation / OpenJS — Node.js runtime + npm ecosystem
Vulnerable versions: all versions running untrusted packages - Python Software Foundation — Python + pip ecosystem
Vulnerable versions: all versions running untrusted packages - Go Project — Go runtime (GolangGhost variant targets)
Vulnerable versions: all versions - Apple — macOS (primary GolangGhost + OtterCookie target)
Vulnerable versions: macOS 12 Monterey through macOS 15 Sequoia - Microsoft — Windows 10 / 11 developer workstations
Vulnerable versions: Windows 10 21H2+; Windows 11 21H2+ - Canonical / Red Hat / Debian — Linux developer workstations
Vulnerable versions: all mainstream distros - Browser Vendors (Google / Mozilla / Microsoft / Brave) — Chrome, Firefox, Edge, Brave, Opera profile stores
Vulnerable versions: all current stable - Crypto Wallet Extensions — MetaMask, Phantom, Binance Chain Wallet, Coinbase Wallet, TronLink, Trust Wallet, Ronin, Exodus (browser ext)
Vulnerable versions: all versions — credential/seed-file theft via browser profile - AnyDesk Software — AnyDesk Remote Desktop (abused, not vulnerable)
Vulnerable versions: silently installed for persistence
Remediation for Void Dokkaebi (Contagious Interview / Famous Chollima)
Immediate actions
- Block known Void Dokkaebi C2 IPs (147.124.214.237, 147.124.214.131, 147.124.212.89, 144.172.74.48, 45.43.11.201, 167.88.36.13, 172.86.123.35) at perimeter and EDR egress policies.
- Alert developers to the fake-interview lure pattern: LinkedIn/X recruiter DMs pushing urgent coding-assignment repos with short review deadlines, MiroTalk or look-alike video-call links, and any request to run unfamiliar npm/pip/go projects on a primary workstation.
- Hunt for AnyDesk silent installs (.msi/.dmg/.pkg) and unexpected AnyDesk service registration on developer workstations in the last 180 days.
- Hunt for `npm install` / `pip install` / `go run` executions followed within 60 seconds by outbound HTTPS to hosting-provider IP ranges (Stark Industries, RouterHosting/BL Networks, Hivelocity) on non-443 high ports.
- Search endpoint telemetry for process-tree `node.exe`/`node` spawning `curl`, `wget`, or `python` with base64-decoded commandlines — a hallmark BeaverTail-to-InvisibleFerret handoff.
Workarounds
- Developers should run untrusted coding assignments in GitHub Codespaces, a disposable Docker container, or a VM snapshot that is reverted after each evaluation.
- Disable npm lifecycle scripts for unvetted repositories: `npm install --ignore-scripts`.
- Use pip's `--no-build-isolation` is NOT sufficient; use a disposable venv in a sandboxed VM.
- Review `package.json` `scripts` section manually before any `npm install` of unfamiliar repos — look for obfuscated or base64-encoded `postinstall`/`preinstall` entries.
Longer-term hardening
- Mandate that developers evaluate unvetted third-party code only inside disposable isolated VMs or cloud-hosted dev sandboxes (GitHub Codespaces, Gitpod) — never on credential-bearing workstations.
- Deploy browser-extension allowlists across managed endpoints and monitor for newly-installed crypto-wallet extensions on corporate devices.
- Enforce hardware-token-backed MFA on email, source-code platforms, cloud consoles, and crypto-exchange accounts used by engineering staff.
- Deploy EDR with behavioral detection for LOLBin-style Node.js, Python, and Go loaders (unsigned interpreter spawning with network egress to hosting-provider ranges).
- Implement network egress filtering from developer subnets — block outbound to hosting-provider ASNs not on an engineering allowlist.
- Run HR/talent-acquisition fraud-awareness training covering reverse-interview lures (candidate-as-victim), and formalize a 'we will never send you a repo to run' policy that can be referenced when verifying recruiter legitimacy.
Weaknesses (CWE) in Void Dokkaebi (Contagious Interview / Famous Chollima)
CWE-506, CWE-829, CWE-494, CWE-1357
Timeline of Void Dokkaebi (Contagious Interview / Famous Chollima)
- First observed Contagious Interview activity targeting developers on freelance platforms with trojanized Node.js assignments; telemetry later correlated back to this period by Unit 42.
- Palo Alto Networks Unit 42 publishes the initial 'Contagious Interview' and 'Wagemole' writeups formally naming the DPRK-aligned cluster (CL-STA-0240) and documenting BeaverTail + InvisibleFerret.
- FBI IC3 publishes PSA240123 on North Korean IT worker fraud, noting overlap with Contagious Interview developer-targeting.
- Securonix publishes the DEV#POPPER campaign analysis, independently documenting the fake-interview lure and Python backdoor matching InvisibleFerret.
- Microsoft Threat Intelligence publishes on Moonstone Sleet with infrastructure and tradecraft overlapping the Contagious Interview cluster.
- ReversingLabs details trojanized npm packages used as coding-assignment lures, including packages impersonating ethers-providers and crypto utilities.
- CrowdStrike publishes 'Famous Chollima' writeup formalizing its naming for the cluster and describing dual-use insider-threat (IT worker) aspect.
- Mandiant publishes UNC5342 clustering on DPRK IT workers and Contagious Interview overlap.
- CISA joint advisory AA24-290A reiterates DPRK cyber actor TTPs including fake-job and IT-worker fraud programs.
- NTT Security Japan publicly discloses OtterCookie, a new JavaScript stealer variant deployed by the same cluster.
- MITRE ATT&CK adds entries for BeaverTail (S1138), InvisibleFerret (S1139), and OtterCookie (S1151).
- Unit 42 publishes updated writeup documenting BeaverTail/InvisibleFerret evolution across 2025, including new C2 infrastructure and cross-platform Qt-based BeaverTail builds.
- Trend Micro publishes 'Void Dokkaebi' writeup documenting GolangGhost variants, MiroTalk-lookalike lure domains, and evolved post-exploitation tradecraft — basis for this Threadlinqs Intelligence threat record.
- As of 2026-05-29, Void Dokkaebi / Contagious Interview (DPRK Famous Chollima) remains an active, escalating campaign: March 2026 reporting found 750+ trojanized repos with worm-like self-propagation, and Trend Micro published a May 2026 InvisibleFerret follow-up. No CVE to patch; the actor is undisrupted (IT-worker fraud arrests hit only facilitators), so the fake-interview/BeaverTail-InvisibleFerret-OtterCookie-GolangGhost chain stays viable.
Sources cited for Void Dokkaebi (Contagious Interview / Famous Chollima)
- Trend Micro — Void Dokkaebi Abuses Code Repositories for Fake Interview Lures
- Unit 42 — Contagious Interview: DPRK Threat Actors Lure Developers with BeaverTail and InvisibleFerret
- Unit 42 — Hacking Employers and Seeking Employment: DPRK IT Worker Overlap
- CrowdStrike — Famous Chollima: A DPRK-Aligned Insider Threat
- FBI IC3 Public Service Announcement — North Korean IT Workers
- MITRE ATT&CK — OtterCookie (S1151)
- MITRE ATT&CK — BeaverTail (S1138)
- MITRE ATT&CK — InvisibleFerret (S1139)
- NTT Security Japan — OtterCookie Analysis
- Microsoft Threat Intelligence — Moonstone Sleet / Jade Sleet Overlap
- Mandiant — Staying a Step Ahead: UNC5342 and DPRK IT Workers
- ReversingLabs — npm Packages Used by Contagious Interview
- Securonix — DEV#POPPER Targeting Developers via Fake Job Interviews
- CISA Advisory AA24-290A — North Korean State-Sponsored Cyber Actors
Threats related to Void Dokkaebi (Contagious Interview / Famous Chollima)
- OtterCandy (js.ottercandy) Node.js RAT/Stealer — WaterPlum's Polymarket-Themed ClickFake Interview Campaign Leaks Its Own Operator Credentials
- PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and Chrome Web Store (DEV#POPPER / OmniStealer)
- GolangGhost/PylangGhost RAT Targets Web3 Job Seekers to Steal Chrome Credentials and MetaMask Data (Famous Chollima / ClickFake Interview)
- PolinRider: DPRK Supply-Chain Campaign Hides BeaverTail/InvisibleFerret Malware in JS Build Config Files (tailwind.config.js et al.)
- Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware as .pyd/.so Files to Evade Script Detection
- AhnLab ASEC April 2026 APT Group Trend Report: State-Sponsored Espionage Campaigns (CVE-2026-32202, CVE-2025-20333/20362, CVE-2021-26855)
Detection coverage for TL-2026-0402
As of 2026-04-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0402 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.