Six npm packages were identified delivering a malicious Node.js loader that uses Ethereum blockchain transactions to resolve C2 infrastructure. Three packages were hijacked legitimate projects with malicious code appended to existing files, and three were newly published packages. The loader queries Ethereum RPC providers, decodes IPv4 addresses from transaction recipient addresses, and retrieves secondary payloads from HTTP endpoints. The activity is attributed to the DPRK-linked Contagious Interview campaign.
Contagious Interview
6 posts
Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads New North Korean campaign uses fake coding interviews to steal developer credentials Elastic Security Labs discovered a new Contagious Interview campaign (REF9403) attributed to DPRK-aligned threat actors that uses fake coding challenges to deliver malware hidden via SVG steganography. The trojanized repositories contain a four-stage JavaScript payload aligned with OTTERCOOKIE, combining browser credential/crypto wallet theft, file exfiltration, a Socket.IO RAT, and clipboard stealing. The malware uses obfuscator.io for code protection, custom Base64 decoding to evade detection, and masquerades as npm-cache processes while exfiltrating data to rightwidth.dev C2 infrastructure.
Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency UNK_DeadDrop is a likely North Korean threat actor conducting broad phishing campaigns targeting software developers with fake job offers and code review requests. The campaign delivers malicious GitHub/GitLab repositories that abuse VS Code and Cursor IDE task automation to silently execute cross-platform malware. Linux and macOS systems receive the Overlord Go RAT with custom credential and wallet theft modules, while Windows runs a fileless Node.js/Python pipeline inside the editor's Electron process. The malware exfiltrates cryptocurrency wallets, browser credentials, and OS keychain data to a hardcoded C&C server at 23.137.105.75:5173.
Famous Chollima Targets PHP Developers Through Compromised Packagist Package A targeted supply chain attack attributed to Famous Chollima compromised a development branch of the legitimate PHP package 'roberts/leads' on Packagist. The attackers injected an obfuscated JavaScript loader into a tailwind.js configuration file, which utilizes blockchain RPC infrastructure as a dead drop to retrieve and execute secondary payloads like DEV#POPPER RAT, likely as part of a Contagious Interview developer lure.
North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads North Korea's Contagious Interview campaign has launched a coordinated supply chain attack across five major open-source ecosystems. The threat actors published malicious packages masquerading as legitimate developer tools that act as staged loaders to deliver remote access trojans (RATs) and infostealers to developer workstations.
NICKEL ALLEY strategy: Fake it ‘til you make it North Korean threat group NICKEL ALLEY is targeting technology professionals and Web3 developers through fake job interviews and malicious code repositories. The group employs social engineering, the ClickFix tactic, and malicious VS Code tasks to deliver remote access trojans like PyLangGhost RAT and BeaverTail, primarily aiming for cryptocurrency theft and potential supply chain compromise.
