North Korea-Linked Hackers Target Developers via Malicious VS Code Projects

The North Korean threat actors associated with the Contagious Interview campaign have been observed using malicious Microsoft Visual Studio Code projects as lures to deliver a backdoor on compromised endpoints. The latest finding, first disclosed by December 2025 and continued with a finding at Jamf Threat Labs, describes a backdoor implant that provides remote code execution capabilities on the victim system.

The attack chain involves targets cloning a repository on GitHub, GitLab, or Bitbucket and launching the project in VS Code as part of a supposed job assessment, with the aim of abusing VS Code task configuration files to run payloads hosted on Vercel domains. The backdoor, known as BeaverTail and InvisibleFerret, is deployed via a tasks.json configuration that triggers when the project is opened, enabling persistent execution and remote control.

The campaign has also been seen concealing multi-stage droppers in task files, and the threat actors reportedly beacon to a remote server every five seconds, returning new JavaScript payloads and erasing traces when signalled. Researchers note that DPRK-aligned actors continue to target software engineers in cryptocurrency, blockchain, and fintech roles to gain privileged access to assets and intellectual property.