Contagious Interview

Contagious Interview

Named by CyberSIXT coverage

Contagious Interview

Named by Malpedia · contagious_interview

Contagious Interview

Named by MISP Galaxy · b2765bd8-1200-4df5-a9d3-72a7b679dcdb

Contagious Interview

Named by MITRE ATT&CK® · G1052

DeceptiveDevelopment

Named by MITRE ATT&CK® · G1052

Gwisin Gang

Named by MITRE ATT&CK® · G1052

PurpleBravo

Named by MITRE ATT&CK® · G1052

TAG-121

Named by MITRE ATT&CK® · G1052

From MITRE ATT&CK® · G1052

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK

1. 22 SepNorth Korean Fake Jobs Infected 30,000 Devices and Stole $10.7mSecurityWeek
2. 9 SepFake macOS Installers Hide OtterCookie Backdoor in North Korean CampaignSecurityOnline
3. 17 JulNew North Korean campaign uses fake coding interviews to steal developer credentialselastic.co
4. 17 JulNorth Korean hackers use fake coding tests to spread OtterCookieThe Hacker News
5. 9 JulNorth Korea-Linked PolinRider Supply Chain Attack Expands Across Open SourceSecurityOnline
6. 15 JunNorth Korean hackers weaponise developer tools to spread malwareThe Hacker News
7. 25 Dec 2025“Contagious Interview” Goes macOS: North Korean Hackers Deploy Stealthy “DriverFixer” StealerSecurityOnline
8. 2 Dec 2025DPRK's 'Contagious Interview' Spawns Malicious Npm Package FactoryDark Reading
9. 17 Nov 2025North Korean threat actors use JSON sites to deliver malware via trojanized codeSecurity Affairs
10. 17 Nov 2025North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail SpywareSecurityOnline
11. 11 Oct 2025North Korean APT “Contagious Interview” Floods npm Registry with 338 Malicious Packages to Steal CryptoSecurityOnline · first in our coverage

• Contagious Interview steps outside the developer workflowOrkl.eu · 25 Sep
• From fake interviews to malicious repositories: Disrupting Contagious InterviewOrkl.eu · 25 Sep
• North Korea Is HiringOrkl.eu · 8 Sep
• Six npm Packages Use Ethereum Transactions to Retrieve Malicious PayloadsOrkl.eu · 14 Aug
• New North Korean campaign uses fake coding interviews to steal developer credentialsOrkl.eu · 21 Jul
• eset-apt-activity-report-q4-2025-q1-2026.pdfOrkl.eu · 20 Jun
• eset-apt-activity-report-q2-2025-q3-2025.pdfOrkl.eu · 20 Jun
• Hunting Lazarus Part VII: The Server That Was Not Just FTPOrkl.eu · 12 May
• Lazarus Group Uses Git Hooks To Hide MalwareOrkl.eu · 7 May
• DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdfOrkl.eu · 16 Oct 2025

• Famous ChollimaNamed together in 2 articles (co-mention)

• MITRE ATT&CK®MITRE ATT&CK: Contagious Interview (G1052)
• MalpediaMalpedia: Contagious Interview