InvisibleFerret

Contagious Interview Hides Malware in Coding Tests

Elastic Security Labs reported a Contagious Interview intrusion tied to a DPRK-aligned threat cluster after suspicious activity targeted Elastic’s community Slack workspace. Using a fake recruiter persona named Maxwell, the operator posted a fraudulent job opportunity and coding challenge that directed victims to trojanized Next.js e-commerce repositories. The malicious code hid payload components inside SVG image files using steganography, embedding Base64 fragments in flag images that were reassembled by serverValidation.js and executed with eval() when the local development server started. The campaign matches the broader Contagious Interview tradecraft tracked in MITRE ATT&CK as G1052, which relies on fake hiring outreach, code-repository lures, and social engineering to infect developers across Windows, macOS, and Linux. Elastic said the infection chain deployed a browser credential and crypto-wallet stealer, a file stealer, a persistent Socket.IO RAT, and a clipboard stealer capable of fetching Windows PE payloads, while code similarities to OTTERCOOKIE and infrastructure overlaps previously documented by JFrog reinforced the attribution. MITRE also associates the cluster with malware such as BeaverTail and InvisibleFerret, along with credential theft, financial theft, persistence through platform-specific startup mechanisms, and exfiltration over C2 and cloud or messaging services.

GolangGhost Steals Chrome Secrets From macOS Keychain and Hijacks MetaMask Permissions | Cryptika Cybersecurity

North Korean-linked threat actor Famous Chollima has been using fake job interviews and skill assessments to infect cryptocurrency and Web3 professionals with the PylangGhost and GolangGhost remote access trojans. Researchers said the operation impersonates firms including Coinbase, Robinhood, Uniswap, Archblock, and Parallel Studios, with lures delivered through LinkedIn, Discord, Telegram, email, and fraudulent interview sites. Victims are told to fix supposed camera or microphone problems by copying and pasting malicious commands, a ClickFix/ClickFake technique that installs malware on Windows and macOS systems; recent reporting said Linux was not targeted in the latest wave. The malware provides remote shell access, file transfer, system reconnaissance, persistence, and theft of browser credentials, cookies, and data from more than 80 browser extensions, including cryptocurrency wallets and password managers. Reporting indicates PylangGhost is a Python-based RAT functionally similar to GolangGhost, while GolangGhost on macOS can also deploy a SwiftUI credential harvester; both families use encrypted HTTP-based command-and-control communications. Investigators also described tailored fake assessment panels, invite-link validation, browser fingerprinting, mobile-device blocking, countdown timers, clipboard hijacking, and typosquatted infrastructure hosted largely through providers such as Hostinger and NameCheap, underscoring a financially motivated DPRK campaign aimed at stealing cryptocurrency and gaining access to company funds.

Post by @lazarusholic.bsky.social - Bluesky

DPRK’s Famous Chollima Deploys RATs Through ClickFake Job Interviews

North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers

New North Korean Campaign Uses Fake Coding Interviews to Steal Developer Credentials | Community Portal | Gurucul

Campagne Contagious Interview : malware DPRK caché dans des SVG via stéganographie | CyberVeille

Lazarus Group Using Git Hooks To Hide Malware | OpenSource Malware Blog