Cybersecurity researchers have identified two malicious cyber campaigns bearing similarities to a persistent North Korean threat cluster known as Contagious Interview (also referred to as Famous Chollima, HexagonalRodent, and Void Dokkaebi).
A report from Proofpoint indicates that the threat actor has been conducting phishing campaigns centered on developer role recruitment or code review themes, targeting nearly 100 organizations across finance, cryptocurrency, education, technology, and other sectors. This activity has been designated as UNK_DeadDrop.
"The infection chain starts with emails containing links to actor-controlled GitHub repositories that host malicious scripts, leading to the execution of cross-platform malware for macOS, Linux, and Windows, including an open-source Go framework called Overlord," stated Proofpoint researchers Saher Naumaan and Carlos Rubio.
A key element linking the campaign to Pyongyang is the use of Microsoft Visual Studio Code (VS Code) projects that leverage the "runOn: folderOpen" technique to trigger malicious code execution each time the code editor is opened, without any user interaction. This method has been employed by the Contagious Interview actors since December 2025.
The activity documented by the enterprise security firm involved over 250 emails sent over a six-week period to individuals across nearly 100 organizations. More than 75% of the targeted entities are based in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands.
The emails contain links to GitHub repositories disguised as technical assignments or cryptocurrency-related projects, instructing recipients to clone the repository and open it in VS Code or Cursor. This results in the execution of operating system-specific malware loaders for Linux, macOS, and Windows. Subsequent lures observed in May 2026 have shifted tactics by asking targets to review their open-source projects.
The loader—a shell script for macOS and Linux, and a VBScript for Windows systems—is designed to install a malicious VS Code extension (VSIX) that poses as a legitimate Google service. It communicates with an external server to facilitate remote command execution, system reconnaissance, and data theft from browser wallet extensions, credentials, and desktop wallet applications.
The Linux and macOS infection chains lead to a customized version of the open-source Overlord framework, which includes capabilities for data theft. It also prompts users to enter their system password via a fake security pop-up. The Windows attack chain, conversely, relies on the VBScript payload to execute a CMD file, which then installs the extension.
The ultimate objective remains consistent: stealing credentials and data from wallet browser extensions and applications, and exfiltrating the results to the server ("23.137.105[.]75:5173") through an HTTP POST request.
"Unlike the Linux/macOS agent, the Windows pipeline does not maintain a persistent connection; it uploads ZIP files, performs cleanup, and terminates," Proofpoint noted.
Further investigation has revealed that the threat actor previously distributed a Windows Go binary of Overlord but has since switched to the new method, likely in an effort to evade detection.
Proofpoint stated it is tracking UNK_DeadDrop separately from Contagious Interview due to differences in initial access methods (LinkedIn vs. email) and the use of the Overlord framework, which differs from the custom malware families traditionally deployed by the North Korean hacking group, including BeaverTail, InvisibleFerret, and OtterCookie.
"UNK_DeadDrop activity suggests that North Korea-aligned operations targeting developers for financial gain are maturing and evolving," the company said. "The shift from active social engineering on social media platforms for fake interviews to large-scale campaigns of recruitment-themed phishing emails distributing links to malicious repositories could indicate an actor industrializing and scaling operations."
This disclosure comes as Yeeth Security reported discovering three malicious VS Code extensions on the official marketplace named "ByteBinTools.jupyter-powerdev-2026.6.8.vsix," "ToolCraft.jupyter-powertools-3.21.0.vsix," and "OLDev.markdown-mode-devtools-2.1.0.vsix." These are disguised as harmless Jupyter Notebook productivity tools but are actually a "sophisticated, multi-stage backdoor" designed to bypass endpoint defenses.
The malware supports the following functions:
A SharePoint site functioning as a command queue, victim registry, and exfiltration channel.
A JavaScript layer handling all command-and-control (C2) communication via Microsoft Graph API and SharePoint.
Components enabling arbitrary file read, write, and exfiltration, as well as code execution using a Windows executable and a Python script for Linux and macOS.
The C2 channel, in addition to running commands or scripts, can issue a third command type called "host_action," which facilitates file system operations like pwd, ls, cd, and cat, along with file uploads and downloads.
Although there is no direct overlap with any publicly documented North Korean campaign, Yeeth Security noted that the developer tooling split between JavaScript and Python echoes Contagious Interview, and that the malicious artifacts' Microsoft Graph API authentication mechanism shares some similarities with the Lazarus Group's Dream Job attacks detailed by S2 Grupo LAB52 in October 2025.
These findings align with the discovery of multiple campaigns linked to North Korean threat actors in recent months:
A follow-up to the Axios supply chain attack using three malicious npm packages (redeem-onchain-sdk@1.0.7, nicegui@0.1.4, and period-newline@0.1.0) that deliver an information stealer exfiltrating harvested data to a different C2 infrastructure. The packages are listed as dependencies on GitHub projects disguised as cryptocurrency trading bots. "Less than 18 hours after the Axios malicious packages were removed from NPM, the first secondary payload was already live on the registry," OpenSourceMalware said. "This suggests the threat actor had prepared backup infrastructure and was ready to immediately deploy alternative delivery mechanisms."
An attack campaign codenamed TaskJacker has been observed dropping malicious VS Code task files into unsuspecting GitHub users' existing repositories, spreading in a worm-like fashion. "By weaponizing VS Code's tasks.json auto-execution feature, attackers have created a scenario where simply opening a cloned repository in your IDE can compromise your system," the OpenSourceMalware team said. "No user interaction required beyond a git clone and opening the folder."
Contagious Interview's use of Git hooks (".githooks/pre-commit") to trigger malicious code execution when a target clones a "coding assessment" repository, marking a shift from hiding malicious code within .vscode/tasks.json or package.json files.
Contagious Interview's use of a compromised Packagist package ("roberts/leads") to target PHP developers with a JavaScript malware loader that reaches out to blockchain and public RPC infrastructure to fetch, decrypt, and execute a next-stage JavaScript payload. The adversary has also leveraged access to compromised developer systems to tamper with commits and inject multi-stage obfuscated JavaScript code into source code files in their repositories. The final payload is a variant of the DEV#POPPER RAT.
"Void Dokkaebi's operations do not end with a single infected developer," Trend Micro said. "The compromised machine becomes a launchpad, with the threat actor weaponizing the victim's own repositories and turning their code contributions into infection vectors for downstream developers. The result is a self-sustaining propagation chain resembling a worm's behavior rather than a traditional targeted attack."
Contagious Interview's migration of InvisibleFerret from readable Python scripts to Cython-compiled binaries, distributing the malware as .pyd files on Windows and .so files on macOS. "The update gives the intrusion set an additional layer of evasion while preserving InvisibleFerret's core capabilities, including backdoor access, browser credential theft, clipboard monitoring, keylogging, and cryptocurrency wallet targeting," Trend Micro said. "BeaverTail has also expanded beyond its original downloader and stealer role into a broader malware with overlapping functions, including credential harvesting and wallet trojanization."
A malicious npm package named "terminal-logger-utils" has been found to target Telegram data, SSH keys, crypto wallets, cloud configurations, and environment variables. The package was published by "jpeek895," an account flagged for publishing a similar package called "terminal-logger-pack" in late April 2026. Another npm package named "js-logger-pack" has been found to deliver an ELF binary with infostealer and remote access trojan (RAT) capabilities.
BlueNoroff's (aka Sapphire Sleet and UNC1069) targeting of macOS environments within high-value financial sectors to deliver infostealer malware as part of targeted social engineering against individuals in the cryptocurrency, investment, and Web3 space. Some of these efforts also use fake Zoom and Microsoft Teams meeting-themed lures and ClickFix-style prompts and instructions to install supposed "missing" meeting SDKs and deliver malicious payloads. The attacks led to the deployment of updated variants of Cabbage RAT (aka CageyChameleon), PowerShell implants capable of credential and data theft, or a newly identified data-stealing macOS toolkit known as Mach-O Man.
"By persuading users to manually execute AppleScript or Terminal-based commands, Sapphire Sleet shifts execution into a user-initiated context, allowing the activity to proceed outside of macOS protections such as Transparency, Consent, and Control (TCC), Gatekeeper, quarantine enforcement, and notarization checks," Microsoft said.
Contagious Trader's use of over 50 malicious packages embedded across more than 100 GitHub repositories targeting developers in the cryptocurrency space to deliver three malware families: PromptMink, OtterCookie, and a new Windows clipboard stealer called ClipViper. "The malicious repositories are promoted through verified accounts on X and Reddit, use spoofed developer identities and bot-inflated star counts to appear legitimate, and are distributed across 40+ GitHub users and organizations as redundant delivery fronts," Panther said.
A cluster of obfuscated malicious npm packages published by multiple throwaway accounts has been found to deliver variants of the OtterCookie infostealer through a postinstall hook. Another malicious npm package named "node-env-resolve" has been identified as using six runtime dependencies that match the OtterCookie toolkit.
Contagious Interview's use of generative artificial intelligence to assist in developing loaders responsible for launching BeaverTail and OtterCookie, and to set up front companies used for listing job openings and social engineering outreach via fake LinkedIn accounts. According to data shared by Expel, these campaigns are likely carried out by multiple teams, each comprising several members. The attacks have resulted in the theft of $12 million in cryptocurrency in the first three months of 2026. "The threat actor's campaigns exfiltrated a total of 26,584 cryptocurrency wallets from 2,726 infected developers' systems," Expel's Marcus Hutchins said.
A supply chain attack campaign codenamed jsonspack has used 27 malicious npm packages to deliver a JavaScript RAT and infostealer, or drop a loader that fetches an unspecified payload. Another malicious npm package named "sleek-pretty" has been found to target developers running Polymarket trading bots to carry out system fingerprinting, SSH backdoor installation, filesystem exfiltration, and targeted theft of Polymarket CLOB API credentials.
A sustained npm malware campaign spanning 108 malicious packages and 261 package versions targeted developers between March 20 and April 20, 2026, with the aim of stealing credentials, Telegram Desktop sessions, and wallet keys, and establishing persistent access using malware families like BeaverTail and OtterCookie.
"Whilst financially motivated cybercrime is highly unappealing to almost every nation-state, since the monetary loss from the resulting sanctions would far outweigh any financial gain, this is not the case for North Korea," Expel said. "The heavy sanctions already levied against the country mean there is little more that can be done to deter them, but a lot to be gained for a nation whose economic activity is severely constrained."