Contagious Interview steps outside the developer workflow

Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks.

September 3 2026 by

Jamf Threat Labs

By Allen Golbig

Introduction

Jamf Threat Labs identified a cluster of macOS disk images (DMG) and installer packages (PKG) impersonating known Mac applications. Every sample in the cluster reaches out to the same staging infrastructure, matching a chain documented by CITIZENDOT in a July 2026 writeup of a fake take-home assignment, and the broader Contagious Interview activity that Jamf Threat Labs and OpenSourceMalware have b…