Contagious InterviewThreat actor

“Famous Chollima’s “Contagious Interview” relied on OtterCookie (malware with Information Theft and remote access capabilities), while PolinRider focused on propagation using compromised GitHub accounts and repositories.”

“North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe”

“North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe”

“The Rust project said the modus operandi overlaps with the Contagious Interview campaign tied to North Korea, urging contributors and crate owners to exercise caution, ensure multi-factor authentication (MFA) is enabled, and check their accounts for unexpected logins.”

“Contagious Interview: Atlassian's security team has published a 44-page report on Contagious Interview, the North Korean hacking op using fake job interviews as a way to infect targets with malware.”

“North Korea's WaterPlum group, commonly referred to as Contagious Interview, has infected at least 30,000 devices in more than 100 countries and taken funds or credentials from over 7,000 cryptocurrency wallets, according to a new joint advisory.”

“The group is involved in North Korea's Contagious Interview operations.”

“Each campaign related to this wave of activity uses social engineering via fake job interview lures, a traditional Contagious Interview approach common among DPRK actors.”

“Researchers have analyzed new macOS delivery activity linked to North Korea’s Contagious Interview campaign.”

“Fireblocks assessed the activity as closely aligned with the North Korea-linked Contagious Interview campaign pattern.”

“…searchers at OpenSourceMalware, who named the technique NullReceiver and attributed the activity they examined to the DPRK-linked Contagious Interview campaign, associated with the Lazarus group.”

“In the Contagious Interview campaign described by Microsoft, fake recruiters convinced developers to clone and trust malicious projects, after which Visual Studio Code ran a project task.”

“Elastic Security Labs found a new Contagious Interview campaign, tracked as REF9403, hiding malware inside SVG image files using steganography.”

“Sekoia's analysts assess with high confidence that this campaign is in the continuity of Contagious Interview, a campaign documented by Palo Alto in November 2023, and that it particularly targets centralised finance entities, aligning with the 2024 trend of Lazarus shifting from…”

“Lazarus y DeceptiveDevelopment continuaron invirtiendo en la construcción de relaciones a largo plazo con objetivos de alto valor, mientras que Kimsuky y Konni favorecieron ataques más rápidos y oportunistas.”

“Lazarus and DeceptiveDevelopment continued to invest in long-term relationship building with high-value targets, while Kimsuky and Konni favored quicker, more opportunistic attacks.”

“…infrastructure choices align with the DPRK-aligned crypto-targeting intrusion clusters that include Lazarus, BlueNoroff, UNC5342 (Contagious Interview), and APT38.”

“| vscode_auto_task | runOn.*folderOpen | VS Code task that executes on folder open (Contagious Interview) |”

“The malware in brief: DEV#POPPER RAT variant”

“Beaver fever has continued into 2024 with the Lazarus-led Contagious Interview campaign still creating all sorts of mayhem.”