Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

The Contagious Interview campaign, linked to North Korean actors, has evolved to use JSON storage services for hosting and delivering malware. This campaign targets software developers, particularly those in cryptocurrency and Web3 projects, across Windows, Linux, and macOS. The attackers use social engineering tactics, including fake recruiter profiles, to deliver trojanized code during staged job interviews. The malware payload includes BeaverTail and OtterCookie infostealers, along with the InvisibleFerret RAT. The attack chain involves multiple stages, from initial contact to malware delivery, utilizing legitimate websites like JSON Keeper and code repositories to operate stealthily. The campaign also incorporates additional components such as the Tsunami Payload, which adds exceptions to Windows Defender and creates scheduled tasks.

• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsCampaign2026-10-08
• New PamStealer variant targets macOS via fake crypto walletMalware2026-09-22
• Uncovering a SectopRAT Variant Embedded in Legitimate SoftwareMalware2026-09-25
• A new version of the MacSync macOS stealer targets crypto enthusiasts and developersMalware2026-09-24