Research reports

Contagious Interview steps outside the developer workflow

Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks. September 3 2026 by Jamf Threat Labs By Allen Golbig Introduction Jamf Threat Labs identified a cluster of macOS disk images…

From fake interviews to malicious repositories: Disrupting Contagious Interview

Software developers and IT professionals are increasingly being targeted through fraudulent recruitment processes that exploit their trust in established development platforms. Candidates are invited to complete seemingly legitimate coding assessments hosted…

North Korea Is Hiring

In short: a North Korean intelligence operation tried to take over my business partner's laptop with a fake job offer. The technique, "Contagious Interview," turns a recruiter's coding "test" into malware that runs the instant you open the project folder.…

Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads

Sonatype Research Labs identified six npm packages delivering the same malicious payload: three hijacked legitimate packages and three additional malicious packages, tracked as sonatype-2026-005899 and sonatype-2026-005901. The malware uses the same Ethereum…

Supply chain

New North Korean campaign uses fake coding interviews to steal developer credentials

Elastic Security Labs found a new Contagious Interview campaign, tracked as REF9403, hiding malware inside SVG image files using steganography. To our knowledge, this specific infection chain has not been previously documented. We found it after the…

Infostealers

Hunting Lazarus Part VII: The Server That Was Not Just FTP

This is Part VII of the "Hunting Lazarus" series. The earlier installments documented the Contagious Interview campaign run by Lazarus Group – the DPRK-linked APT – which targets cryptocurrency and Web3 developers with fake job interviews, fabricated company…

State-sponsored

Lazarus Group Uses Git Hooks To Hide Malware

The OpenSourceMalware team has spotted a fresh twist in the DPRK's Contagious Interview / TaskJacker playbook: the operators have pivoted away from stuffing their stage-2 loader into .vscode/tasks.json , package.json postinstall scripts, or fake .woff2 font…

State-sponsoredMalware

DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdf

DECEPTIVEDEVELOPMENT: FROM PRIMITIVE CRYPTO THEFT TO... HAVRÁNEK & KÁLNAI 2 VIRUS BULLETIN CONFERENCE SEPTEMBER 2025 ABSTRACT DeceptiveDevelopment, also known as Contagious Interview, is a North Korea-aligned group whose activities have increased in…