From fake interviews to malicious repositories: Disrupting Contagious Interview
North Korean threat actors use fake coding assessments on Bitbucket, GitHub, and GitLab to deliver BeaverTail malware that steals credentials and deploys secondary payloads targeting software developers. Contagious Interview is a North Korean campaign using fraudulent recruitment to deliver BeaverTail malware through coding assessment repositories on developer platforms. The loader steals credentials, cryptocurrency wallets, and API tokens, then delivers secondary malware outside the hosting platform. Hundreds of malicious repositories and accounts have been taken down, but victims can become unintended distributors by uploading copies.
Detection / Hunteropenrouter
Immediate Actions
- Disconnect affected device from network and notify security team.
- Revoke sessions, passwords, tokens, SSH keys, cloud credentials, and API keys.
- Transfer cryptocurrency assets to new wallet created on clean device.
- Reimage affected device; antivirus alone won't remove follow-on malware.
Key Takeaways
- BeaverTail loader concealed in repositories with thousands of lines of plausible code.
- Nearly half of malicious repositories used two or more execution techniques.
- Later-stage malware delivered outside Bitbucket after initial loader execution.
- Victims uploading assessment recordings become unintended distribution chain links.
- Infrastructure overlaps found with dozens of other North Korea-attributed campaigns.
Attack Chain
- Initial Access: Fake recruitment via LinkedIn and Upwork soliciting coding assessments
- Delivery: Malicious repositories hosted on Bitbucket, GitHub, GitLab with concealed BeaverTail loader
- Execution: Victim runs code assessment, triggering BeaverTail using multiple evolving techniques
- Persistence: Backdoor execution and persistence establishment on compromised host
- Collection: Steals credentials, crypto wallets, API tokens, browser data, SSH keys
- Exfiltration: Data exfiltrated via HTTP/WebSocket; secondary malware delivered outside hosting platform
Affected Systems
- Windows, macOS, and JavaScript runtime environments
- Visual Studio Code users with automatic tasks enabled
- Software developers and IT professionals targeted via recruitment
- Bitbucket, GitHub, and GitLab repository hosting platforms
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Process spawning and file access patterns visible to EDR; script content obfuscation limits visibility into payload logic. |
| Network Visibility | Medium | HTTP uploads and WebSocket connections visible at network layer; encrypted channels may obscure exfiltrated content. |
| Detection Difficulty | Hard | Malicious payloads concealed in few lines among thousands; multiple evolving execution techniques complicate signature development. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| IDE or terminal spawning scripting runtimes referencing .vscode, hidden directories, or downloaded dependency scripts (T1059). | Process creation with parent IDE and child script interpreter. | Execution | Medium — legitimate dev tasks use similar patterns |
| Scripting processes accessing browser profiles, password stores, or keychains followed by HTTP uploads or WebSocket connections (T1555, T1567). | File access audit logs correlated with network connection events. | Collection | Low — dev scripts rarely access credential stores |
| New repository with recruitment or crypto-themed naming containing concealed loader code among thousands of lines (T1027). | Git clone logs and file integrity monitoring on repos. | Initial Access | Medium — legitimate coding assessments use similar themes |
Required Log Sources
- Process creation and command-line logs
- IDE application and VS Code logs
- Network proxy and firewall logs
- DNS resolution logs
- File access and audit logs
Key Behavioral Indicators
- IDE or terminal spawning unexpected shells referencing .vscode
- Scripting processes accessing .ssh, browser profiles, or keychains
- HTTP uploads or WebSocket connections following credential store access
- Repository names combining recruitment and crypto/web3 keywords
- Multiple execution techniques triggered from single repository
- VS Code automatic tasks executing unexpected scripts
Control Gaps
- Signature-based AV misses payloads concealed in large repositories
- Code review may miss malicious code among thousands of lines
- Network-only monitoring misses host-level credential and file access
- Git platform scanning may not detect multi-file obfuscation
False Positive Assessment
Medium — legitimate coding assessments are common, but credential store access and concealed payloads in large repos are rare in normal development.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Set task.allowAutomaticTasks to off in Visual Studio Code.
- Alert on IDE or terminal spawning unexpected shells or scripting runtimes.
- Alert on scripting processes accessing browser profiles, password stores, or keychains.
- Monitor for HTTP uploads or WebSocket connections from scripting processes.
User Protection
- Use dedicated isolated environment for coding assessments and take-home tests.
- Do not run unfamiliar repository code on corporate workstations with production credentials.
- Report suspicious repositories and recruiter accounts to hosting and recruitment platforms.
Security Awareness
- Verify recruiter legitimacy through independent channels before engaging with coding assessments.
- Be cautious of assessments in public repos with recruitment-themed naming conventions.
MITRE ATT&CK Mapping
Resource Development
Initial Access
Stealth
Credential Access
Collection
Command and Control
Exfiltration
Plain-Language Summary
North Korean hackers pretend to recruit software developers by giving them coding tests with hidden malware in online code repositories. When developers run the code, it steals their passwords, cryptocurrency wallets, and company credentials, then installs additional malicious software. Anyone who ran code from an unfamiliar job assessment should disconnect their device, change all passwords, move cryptocurrency to a new wallet, and reformat the device. Organizations should warn developers and monitor for unusual activity from coding tools.