North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail Spyware

According to NVISO, North Korea’s Contagious Interview APT has evolved to host and deliver malware from trojanised code projects by using JSON storage services such as JSON Keeper, JSONsilo, and npoint[.]io, alongside GitLab and GitHub to blend into developer workflows.

The campaign, active since at least 2023 and targeting software engineers, blockchain developers and Web3 professionals, lures victims with recruiter personas and job interview fabrications before directing them to a GitLab project that contains a hidden payload. The file server/config/.config[.]env holds a base64-encoded variable masqueraded as an API key, which decodes to a JSON storage service URL hosting obfuscated JavaScript that, when loaded, delivers BeaverTail, an infostealer.

BeaverTail harvests credentials and crypto wallets, exfiltrates system information and documents, and can scan browser data; it then fetches the next stage, InvisibleFerret, a modular Python RAT with components for persistence, exclusions, and remote payload delivery via Pastebin. NVISO notes the actors are broadening their reach and emphasises the abuse of legitimate JSON storage and code hosting services to stay stealthy.