# Void Dokkaebi (Contagious Interview / Famous Chollima) — DPRK Fake Job Interview Campaign Delivering BeaverTail, InvisibleFerret, OtterCookie & GolangGhost via Trojanized Code Repositories

> Void Dokkaebi — tracked by Unit 42 as Contagious Interview (CL-STA-0240) and by CrowdStrike as Famous Chollima — is a DPRK-aligned cluster that social-engineers software developers via fake LinkedIn, X, GitHub, and freelance-platform recruiter personas into cloning and executing trojanized Node.js/Python/Go coding-assignment repositories. Execution of the repo (typically triggered by `npm install` or running a test harness) stages the BeaverTail JavaScript infostealer, the InvisibleFerret Python multi-stage backdoor, the newer OtterCookie JavaScript stealer, and Go-language GolangGhost variants to steal browser credentials, crypto wallets, and enable persistent remote access via AnyDesk — generating sanctioned-regime revenue and, in some victims, bridging into the overlapping DPRK IT-worker fraud program.

- **Published:** 2026-04-21T12:00:00Z
- **Last reviewed:** 2026-04-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0402
- **ID:** TL-2026-0402
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** WageMole (North Korea)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Void Dokkaebi is the Trend Micro designation for a DPRK-aligned intrusion cluster overlapping with Palo Alto Unit 42's Contagious Interview (CL-STA-0240) and CrowdStrike's Famous Chollima. The cluster has been active since at least late 2022 and, per the 2026-04-21 Trend Micro writeup, has evolved its malware arsenal and lure infrastructure while maintaining the core 'fake job interview' social-engineering chain.

Initial access begins on professional and developer-facing platforms — LinkedIn, X (Twitter), GitHub, Upwork, Freelancer.com, We Work Remotely, and Telegram developer groups. Operators pose as recruiters or hiring managers at plausible but fictitious companies, or spoof well-known crypto and fintech brands, and open dialogue with targeted developers (particularly those listing JavaScript, Node.js, React, Python, Go, or Web3/Solidity skills). After rapport-building over several days, the operator schedules a 'technical interview' — frequently on hijacked or look-alike MiroTalk, freeconference, or Google Meet domains — and asks the candidate to clone a GitHub or Bitbucket repository presented as a 'coding assignment,' 'bug fix task,' or 'fork of our production code.'

The repositories are otherwise-functional Node.js, Python, or Go projects (often cryptocurrency dashboards, trading bots, or Web3 wallets) that contain obfuscated malicious code buried inside utility files, post-install hooks, or deeply nested package subdirectories. Execution paths include: (a) malicious `postinstall` or `preinstall` scripts in `package.json` that fire on `npm install`; (b) JavaScript loaders hidden inside minified or heavily commented test files; (c) Python `setup.py` hooks or runtime-imported modules; (d) Go-compiled droppers for GolangGhost variants. Developers running the repo — frequently on their own workstations rather than an isolated VM — execute the loader under their own user context.

Stage 1 (BeaverTail) is a heavily obfuscated JavaScript infostealer (and, in newer cross-platform variants, a Qt/Electron bundle) that enumerates and exfiltrates Chromium, Brave, Edge, Firefox, and Opera browser profile data (cookies, saved logins, autofill, extension data), targets ~20 cryptocurrency wallet browser extensions (MetaMask, Phantom, Binance Chain, Coinbase Wallet, TronLink, Trust Wallet, Exodus browser ext, Ronin, etc.), and harvests macOS Keychain, SSH keys, AWS/GCP credential files, and iCloud Keychain artifacts where reachable. BeaverTail then downloads Stage 2 from an operator-controlled C2 host.

Stage 2 (InvisibleFerret) is a Python-based modular backdoor delivered as compressed, base64-encoded payload chunks. Functionality includes: command execution, file enumeration and exfiltration, keylogging, screen capture, browser-credential and crypto-wallet stealing (complementary to BeaverTail), and the silent installation of AnyDesk as a persistent remote-management channel. InvisibleFerret establishes persistence via OS-specific mechanisms (LaunchAgents on macOS, Registry Run keys on Windows, systemd user units or cron on Linux).

OtterCookie — first documented by NTT Security in December 2024 and evolved across 2025 — is a newer JavaScript stealer variant occasionally deployed alongside or in place of BeaverTail. OtterCookie uses Socket.IO for C2, specifically targets cryptocurrency-related keychain items and wallet files, and carries an extended anti-analysis layer including VM detection. GolangGhost is a Go-language rewrite family observed in 2025-2026 that consolidates the stealer-plus-backdoor functionality into a single cross-platform (macOS-focused) binary — a direct response to endpoint detection improvements against the noisy JS/Python chain.

Stolen credentials, cryptocurrency, and system access are monetized directly (wallet draining) and used operationally to stage follow-on intrusions, including cases where the same victim is later re-targeted by DPRK IT-worker operators to exfiltrate corporate source code and IP. Revenue ultimately flows to the DPRK regime in violation of UN and US sanctions. The FBI, Mandiant, Microsoft Threat Intelligence, and multiple national CERTs have issued advisories emphasizing the cross-pollination between Contagious Interview (developer-as-victim) and the broader DPRK IT-worker fraud program (developer-as-insider).

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1593.001 Social Media
- T1585.001 Establish Accounts: Social Media Accounts
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1587.001 Develop Capabilities: Malware
- T1608.001 Stage Capabilities: Upload Malware
- T1566.003 Phishing: Spearphishing via Service
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1543.001 Create or Modify System Process: Launch Agent
- T1053.003 Scheduled Task/Job: Cron
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.001 Credentials from Password Stores: Keychain
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1056.001 Input Capture: Keylogging
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1217 Browser Information Discovery
- T1119 Automated Collection
- T1560 Archive Collected Data
- T1113 Screen Capture
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Trend Micro — Void Dokkaebi Abuses Code Repositories for Fake Interview Lures](https://www.trendmicro.com/en_us/research/26/d/void-dokkaebi-fake-interview-code-repositories.html)
- [Unit 42 — Contagious Interview: DPRK Threat Actors Lure Developers with BeaverTail and InvisibleFerret](https://unit42.paloaltonetworks.com/contagious-interview-beavertail-invisibleferret/)
- [Unit 42 — Hacking Employers and Seeking Employment: DPRK IT Worker Overlap](https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/)
- [CrowdStrike — Famous Chollima: A DPRK-Aligned Insider Threat](https://www.crowdstrike.com/blog/famous-chollima-insider-threat/)
- [FBI IC3 Public Service Announcement — North Korean IT Workers](https://www.ic3.gov/Media/Y2024/PSA240123)
- [MITRE ATT&CK — OtterCookie (S1151)](https://attack.mitre.org/software/S1151/)
- [MITRE ATT&CK — BeaverTail (S1138)](https://attack.mitre.org/software/S1138/)
- [MITRE ATT&CK — InvisibleFerret (S1139)](https://attack.mitre.org/software/S1139/)
- [NTT Security Japan — OtterCookie Analysis](https://jp.security.ntt/tech_blog/ottercookie)
- [Microsoft Threat Intelligence — Moonstone Sleet / Jade Sleet Overlap](https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor/)
- [Mandiant — Staying a Step Ahead: UNC5342 and DPRK IT Workers](https://www.mandiant.com/resources/blog/dprk-it-workers)
- [ReversingLabs — npm Packages Used by Contagious Interview](https://www.reversinglabs.com/blog/fake-recruiter-coding-tests-target-devs-with-malicious-python-packages)
- [Securonix — DEV#POPPER Targeting Developers via Fake Job Interviews](https://www.securonix.com/blog/analysis-of-dev-popper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/)
- [CISA Advisory AA24-290A — North Korean State-Sponsored Cyber Actors](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-290a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0402