'Contagious Interview' Attack Now Delivers Backdoor Via VS Code

The Contagious Interview campaign is now delivering a backdoor via a maliciously crafted Visual Studio Code workflow, enabling remote code execution on developer systems once trust is granted to the repository’s author. Jamf Threat Labs disclosed the latest infection method earlier this week and described it as the newest evolution in an ongoing campaign that has targeted software developers through fraudulent job recruitment schemes since at least late 2023.

The attack blends into developer workflows by prompting victims to clone and open repos hosted on GitHub or GitLab, after which Visual Studio Code processes a malicious configuration file that executes arbitrary commands on the victim’s system without further user interaction. Victims on macOS trigger a hidden command that downloads and runs a JavaScript file via Node.js, with the code continuing to run even if VS Code is closed.

Contagious Interview is a data theft campaign security researchers have attributed with a high degree of confidence to North Korean threat actors, who are reported to deploy infostealers to extract credentials and impersonate developers. Jamf’s advice to developers is to vet third-party repositories and review repository contents before trusting them in Visual Studio Code, and to be cautious with npm install scripts and package.json during the hiring-related workflow. January 21, 2026.