North Korean Contagious Interview Campaign Abuses Developer Tools for Malware Delivery

Executive Summary

Proofpoint researchers identified a large-scale campaign attributed to a North Korean threat cluster known as Contagious Interview. The operation targets software developers using fake recruitment opportunities, code review requests, malicious GitHub repositories, and weaponized developer tools. The threat actor distributes malware through Visual Studio Code projects, malicious VS Code extensions, npm packages, Git hooks, cryptocurrency-related repositories, and software supply chain compromises. The primary objective is credential theft, cryptocurrency theft, and financial gain.

Key Intelligence Overview

Threat Actor Profile

Contagious Interview is a North Korean cybercrime operation known for targeting developers through fake job interviews, coding assessments, open-source projects, and software repositories. The actor has evolved from social engineering on LinkedIn into large-scale phishing operations delivered through email campaigns and malicious development resources.

Known Aliases

• Contagious Interview
• Void Dokkaebi
• Famous Chollima
• HexagonalRodent

Targeted Industries

• Technology Companies
• Cryptocurrency Organizations
• Financial Institutions
• Educational Institutions
• Software Development Teams
• Open Source Communities

Campaign Timeline

Attack Chain Analysis

Initial Access

Victims receive phishing emails containing links to malicious GitHub repositories disguised as technical assignments or cryptocurrency projects.

Execution

Opening the repository inside Visual Studio Code triggers automatic execution through the runOn:folderOpen feature.

Persistence

Malicious VS Code extensions establish long-term access and enable remote command execution.

Credential Access

The malware steals browser credentials, wallet information, developer secrets, and authentication tokens.

Collection

Sensitive files, cryptocurrency wallet data, SSH keys, cloud configurations, and development credentials are collected.

Exfiltration

Collected data is transmitted to attacker-controlled infrastructure through HTTP POST requests and cloud-based command channels.

Malware Families Observed

• Overlord Framework
• BeaverTail
• InvisibleFerret
• OtterCookie
• DEV#POPPER RAT
• PromptMink
• ClipViper
• Cabbage RAT

MITRE ATT&CK Mapping

Indicators of Interest

• Malicious GitHub Repositories
• Malicious VSIX Extensions
• runOn:folderOpen Execution
• 23.137.105.75:5173
• Compromised npm Packages
• Fake Recruitment Emails

Detection Opportunities

• Monitor unexpected VS Code extension installations.
• Review execution of tasks.json and runOn settings.
• Monitor outbound communications from developer systems.
• Detect suspicious Git hooks and repository changes.
• Inspect npm package dependencies.
• Review browser wallet extension activity.

Defensive Recommendations

1. Verify technical assignments before execution.
2. Disable automatic VS Code task execution where possible.
3. Review third-party extensions before installation.
4. Use MFA for developer accounts.
5. Implement software supply chain security controls.
6. Monitor repository modifications and commits.
7. Conduct threat hunting for malicious developer tooling.

Analyst Assessment

Contagious Interview represents one of the most advanced developer-focused cybercrime operations currently active. The group's ability to weaponize software development workflows, open-source ecosystems, IDEs, package managers, and recruitment processes demonstrates a highly adaptive threat model. Organizations employing developers, DevOps engineers, blockchain engineers, and software architects should consider this threat actor a high-priority risk.

References

• The Hacker News – North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels
• Proofpoint Threat Research
• MITRE ATT&CK Framework

Share Report