Threat Actors Use JSON Storage for Hosting and Delivering Malware via Trojanized Code

A sophisticated campaign dubbed Contagious Interview is attributed to North Korean-aligned threat actors, who are weaponising legitimate JSON storage services to deliver malware to software developers worldwide. The operation has been active since at least 2023 and targets developers across Windows, Linux and macOS, with a focus on people involved in cryptocurrency and Web3 projects.

The attackers begin with social engineering, creating fraudulent recruiter profiles on professional networks such as LinkedIn and guiding targets to a “demo project” hosted on GitLab, where base64-encoded variables masquerade as benign API keys and reveal URLs to JSON storage services including JSON Keeper, JSON Silo and npoint[.]io.

These services host heavily obfuscated JavaScript that is fetched and executed at runtime, after which BeaverTail exfiltrates data such as browser profiles and cryptocurrency wallet extensions, and on macOS systems the Keychain database containing passwords.

BeaverTail then fetches InvisibleFerret, a modular Python-based Remote Access Trojan, to provide persistence and full system control, while the campaign employs advanced persistence techniques through the Tsunami framework, including RSA signature verification for payload integrity. Security researchers noted that multiple JSON storage providers confirmed removal of malicious content as investigators pivoted on indicators.