Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware as .pyd/.so Files to Evade Script Detection
Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware (TL-2026-2145), also tracked as Contagious Interview, is a high-severity malware campaign, first published 2026-08-25. It is attributed to WageMole (North Korea) with high confidence, affects Generic Windows developer workstations with a Python interpreter, maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1056.001), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-2145
- Threat ID
- TL-2026-2145
- Also known as
- Contagious Interview
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-25
- Last reviewed
- 2026-08-25
- Attribution
- WageMole
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, financial services, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware
Malware and tooling: BeaverTail - S1246, InvisibleFerret - S1245, cjs, gjs, njs, zjs, Coinbase Wallet, MetaMask, Phantom
North Korea-linked Void Dokkaebi (aka Famous Chollima / Contagious Interview) has upgraded its InvisibleFerret information-stealer and BeaverTail loader from plaintext Python/JavaScript into Cython-compiled native binaries (.pyd on Windows, .so on macOS), defeating script-pattern detection. The malware is delivered via fake recruiter/job-interview lures that induce developers to clone and run malicious Git repositories, then harvests browser credentials, clipboard data, keystrokes, and cryptocurrency wallet assets (MetaMask, Coinbase Wallet, Phantom).
How Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware works
Void Dokkaebi, a North Korea-aligned intrusion set tracked elsewhere as Famous Chollima, Contagious Interview, Wagemole, CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, UNC5342, and (as of June 2026) HexagonalRodent, runs a long-running employment-fraud and developer-targeting operation assessed active since at least 2018. The group's core playbook is to impersonate recruiters from cryptocurrency and AI companies on professional networking platforms, walk a developer through a fabricated interview process, and instruct them to clone a GitHub/GitLab/Bitbucket repository and run it as a 'technical assessment.' A companion April 2026 Trend Micro report documented the scale of this repo-based distribution model: more than 750 infected public repositories, over 500 malicious VS Code task configurations, and 101 cases of a custom batch script tampering with commits to conceal the injected code.
The malware delivered through this lure is a two-part toolkit. BeaverTail is a JavaScript-based loader/stealer that has evolved from a simple downloader into a multi-function tool with four variants: gjs (data theft and component download), njs (backdoor functions), zjs (wallet seed-phrase and private-key theft), and cjs (installs trojanized cryptocurrency wallet browser extensions). InvisibleFerret is the Python-based second-stage stealer/backdoor, itself split into modules: mod (initial C2 connection and payload download), pad (backdoor access and system enumeration), brw (browser credential and payment-card theft), and, on macOS only, mc (trojanized wallet-extension installation).
The upgrade documented in Trend Micro's May 25, 2026 analysis (the basis for this threat) is a defense-evasion change to how InvisibleFerret and BeaverTail's payload modules are shipped: rather than distributing readable Python/JavaScript source, the group now compiles the stealer modules with Cython into native Python extension binaries — .pyd on Windows and .so on macOS — dropped alongside small execution scripts (.mod, pad0, brw0, mc0) inside the project's .vscode directory. Because these binaries load into the Python interpreter as native extension modules rather than running as visible script text, security tools that pattern-match on Python/JavaScript source code do not flag them, even though the underlying stealer logic (browser credential theft, clipboard monitoring, keystroke logging, wallet targeting) is unchanged. Analysts can still recover module initialization functions and embedded file-system paths from the compiled binaries, including a build artifact path (/Users/administrator/Pictures/Work/py_module_work/) left over from the actor's development environment. Additional obfuscation layers include Base64 fragment shuffling at startup, 4-byte XOR-encrypted strings, zlib-compressed segments containing the original Python logic, and C2 IP addresses that are split, byte-swapped, and Base64-encoded before being embedded or passed at runtime.
On the network side, one secondary source (cybersecuritynews.com) reports a specific C2 IP, 45.59.160.199, reached over HTTP at path patterns /clw/{sType} (Windows) and /clw1/{sType} (macOS), plus use of the legitimate ip-api.com geolocation service to fingerprint victim location. A second independent secondary source covering the same Trend Micro research (gbhackers.com) instead states that C2 details are NOT fully embedded in the compiled binaries but are passed dynamically via command-line arguments from the execution script, which it flags as a deliberate complication for static analysis. Both statements can be true simultaneously (an IP observed in one deployment, with the mechanism generally supporting runtime override), but the primary Trend Micro report could not be directly retrieved (HTTP 403) to resolve the discrepancy, so the 45.59.160.199 indicator should be treated as medium-confidence, single-secondary-source-attributed rather than confirmed against the primary research.
Separately, on macOS, the group has been reported to force a Chrome version downgrade in order to bypass current browser extension security controls before installing trojanized MetaMask, Coinbase Wallet, and Phantom extensions; Brave Browser is also targeted. The broader Void Dokkaebi/Contagious Interview cluster has a documented history of front companies used to lend the recruiter lure legitimacy (e.g., BlockNovas LLC, seized by the FBI on April 23, 2025, alongside Angeloper Agency and SoftGlide LLC), and a June 2026 Proofpoint-sourced report ties related developer-recruitment phishing to nearly 100 targeted organizations across finance, cryptocurrency, education, and technology sectors, delivering cross-platform (Windows/macOS/Linux) malware via actor-controlled GitHub repositories linked from phishing emails.
MITRE ATT&CK techniques used in TL-2026-2145
Collection
T1005 Data from Local System; T1056.001 Keylogging
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Execution
T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1132.001 Standard Encoding
Persistence
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1566.003 Spearphishing via Service
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
T1585.001 Social Media Accounts
Discovery
T1614 System Location Discovery
Impact
Affected products and versions in Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware
- Generic — Windows developer workstations with a Python interpreter
Vulnerable versions: all versions capable of loading .pyd extension modules - Generic — macOS developer workstations with a Python interpreter
Vulnerable versions: all versions capable of loading .so extension modules - Microsoft — Visual Studio Code
Vulnerable versions: workspaces with malicious task configurations dropped under .vscode/ - Google — Chrome
Vulnerable versions: downgraded installs on macOS used to bypass current extension security controls
Remediation for Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware
Immediate actions
- Treat any developer machine that cloned an unsolicited 'technical assessment' repository as compromised and isolate it from credential stores and CI/CD pipelines
- Hunt for mod.pyd/pad.pyd/brw.pyd (Windows) and mod.so/pad.so/brw.so/mc.so (macOS) inside .vscode directories and quarantine on detection
- Monitor for and block anomalous outbound HTTP requests matching /clw/{sType} or /clw1/{sType} path patterns, and treat 45.59.160.199 as a medium-confidence block candidate pending further validation
- Revoke and rotate credentials, wallet seed phrases, and signing keys on any workstation that executed a cloned interview-assignment repository
Workarounds
- Disable automatic task execution for untrusted VS Code workspaces
- Require code review and static/dynamic sandbox analysis of any repository supplied as part of a job interview or coding assessment before it is ever executed on a corporate or personal workstation
Longer-term hardening
- Shift endpoint/EDR detection from Python/JavaScript-script pattern matching to binary-aware monitoring of compiled .pyd/.so Python extension modules
- Enforce policy requiring interview or technical-assessment code to run only in disposable, network-isolated sandboxes, never on machines with wallet or CI/CD access
- Deploy behavioral detection for trojanized browser-extension installation (MetaMask, Coinbase Wallet, Phantom) and unexpected Chrome version downgrades on macOS
- Audit repositories and VS Code workspace configurations for injected task configurations and commit-history tampering
Timeline of Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware
- Void Dokkaebi / Famous Chollima assessed by CrowdStrike as active since at least 2018, running employment-fraud operations to fund North Korean state interests.
- FBI seizes BlockNovas LLC, one of the fake cryptocurrency-consulting front companies (alongside Angeloper Agency and SoftGlide LLC) used by the same Contagious Interview/Void Dokkaebi cluster to lend its recruiter lure legitimacy while distributing BeaverTail and InvisibleFerret.
- Trend Micro publishes research documenting Void Dokkaebi's fake job-interview lure spreading malware via code repositories, uncovering more than 750 infected public repositories, 500+ malicious VS Code task configurations, and 101 cases of commit-tampering batch scripts.
- cybersecuritynews.com and gbhackers.com independently publish analyses of the same Trend Micro findings the same day, corroborating the module structure and evasion technique while diverging on whether C2 details are embedded in the binaries or passed via command-line arguments at runtime.
- Trend Micro discloses that Void Dokkaebi has repackaged InvisibleFerret and BeaverTail's stealer modules as Cython-compiled native binaries (.pyd on Windows, .so on macOS) to defeat script-pattern detection tooling.
- A Proofpoint-sourced report covered by The Hacker News ties related developer-recruitment phishing (delivering cross-platform malware via actor-controlled GitHub links) targeting nearly 100 organizations across finance, cryptocurrency, education, and technology sectors to the same Contagious Interview/Famous Chollima/Void Dokkaebi cluster, adding the alias HexagonalRodent.
Sources cited for Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware
- Analyzing Void Dokkaebi's Cython-Compiled InvisibleFerret Malware
- InvisibleFerret Malware Now Ships as .pyd and .so Files to Evade Script Detection
- InvisibleFerret Malware Uses .pyd and .so Files to Evade Script Detection
- Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories
- Void Dokkaebi Spreads Malware via Fake Git Repos
- North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels
- Famous Chollima Adversary Profile
- North Korean Hackers Spread Malware via Fake Crypto Firms and Job Interview Lures
Threats related to Void Dokkaebi Ships Cython-Compiled InvisibleFerret Malware
- OtterCandy (js.ottercandy) Node.js RAT/Stealer — WaterPlum's Polymarket-Themed ClickFake Interview Campaign Leaks Its Own Operator Credentials
- Void Dokkaebi (Contagious Interview / Famous Chollima) — DPRK Fake Job Interview Campaign Delivering BeaverTail, InvisibleFerret, OtterCookie & GolangGhost via Trojanized Code Repositories
- TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Repos
- North Korean Contagious Interview Campaign Deploys OtterCookie via SVG Steganography to Steal Developer Credentials
- RemotePE: In-Memory Lazarus RAT Delivered via DPAPILoader and RemotePELoader Multi-Stage Chain
Detection coverage for TL-2026-2145
As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2145 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.