North Korean threat actors use JSON sites to deliver malware via trojanized code

North Korea-linked actors behind the Contagious Interview campaign have updated their tactics to host and deliver malware from trojanised code projects using legitimate JSON storage services such as JSON Keeper, JSON Silo, and npoint[.]io. According to NVISO, the operators lure software developers on Windows, Linux and macOS with pretend interview processes and demo projects, positioning a hidden Base64 API key that points to a JSON storage service hosting the next malware stage.

The delivered payload is BeaverTail, a JavaScript infostealer that can deploy the Python backdoor InvisibleFerret, and it now fetches an extra tool called TsunamiKit from Pastebin. Earlier data shows TsunamiKit is used alongside other malware to profile systems, steal data, and pull additional payloads from a Tor site that is currently offline.

Researchers noted that the campaign also uses GitHub-like code repositories and legitimate websites to blend in with normal traffic, with the aim of exfiltrating sensitive data and crypto wallet information. 17 November 2025.