Contagious Interview campaign expands with 197 npm Ppackages spreading new OtterCookie malware

The Contagious Interview campaign, linked to North Korean threat actors, has expanded with the addition of 197 new malicious npm packages designed to distribute an updated version of OtterCookie malware. This campaign targets software developers, particularly in the crypto and Web3 sectors, using social engineering tactics such as fake job interviews. The malware, which includes infostealers and remote access tools, is delivered through compromised npm packages that execute malicious code upon installation.

The attackers utilize a sophisticated infrastructure involving GitHub for storage, Vercel for payload delivery, and a separate command and control server for data theft. The campaign has seen over 31,000 downloads of these malicious packages, indicating its widespread impact.